d53b084aa049a80fd2f7f81f7cf07cc1b48fd26603ffe092aa8cda178f7734da

General

Target
d53b084aa049a80fd2f7f81f7cf07cc1b48fd26603ffe092aa8cda178f7734da
Size 7.6MB
Sample260730-hladessfrd
SHA256 d53b084aa049a80fd2f7f81f7cf07cc1b48fd26603ffe092aa8cda178f7734da
MD5 8183854175dd7de9ad645dd8f5b341a3
SHA1 26fd24cdd12ba9ed67ba279678a5604a260af051
SHA512 4053c6027eb4a92984c9162a4ab3c62c82f0ab5f501104d06664c396bb6524eb1787e5f82437167a7dc664eebb7361d9a3cd40b101b3ed6f6fab0a3c857d67ff
SSDEEP 196608:8IriUd3n3NdrYv9Bj6UxxWh//dVUiK+rviQJ6AqxB:8IxdNaBjjxxWLLraQOB
TLSH
T16D8633AA7D1F0DD110045F4269985D3CFAB268D2D2189822F23D7A2F4E336399D77CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8005.msi
- Size 7.7MB
- SHA256 460f24bf50d8b1c3f7f54e48f6fa9d3a60d97c3e0dea2bc7675dacc2f0a8baca
- MD5 92184295f91d6e14a72793988a445870
- SHA1 b0fb1683c74a739091f1d173bf0709edae08d9f6
- SHA512 087b5e07ddf06dee995efb0edd4282df1a5ddd08318dcf2f29541ada6dbfb26349dcdc212f7be286ea0276f11078409fd58d29484cb1fabfdcdd49ae29903f4c
- SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2GM:ZBajlEeW2nRo+z
- TLSH
  T1F08633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence privilege_escalation ransomware defense_evasion discovery execution exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2