7d2ae6102b99d0b8991e08ef2ba8d659b35ae054c261d5fe14d7b60ed03651dd

General

Target
7d2ae6102b99d0b8991e08ef2ba8d659b35ae054c261d5fe14d7b60ed03651dd
Size 7.6MB
Sample260730-kcbagaxycs
SHA256 7d2ae6102b99d0b8991e08ef2ba8d659b35ae054c261d5fe14d7b60ed03651dd
MD5 1da38c6fec3b7e57738d76fee6a286fb
SHA1 04307fc4f916f1a3d3818d9f2def47165b69dd3d
SHA512 731657848f1c5bf3b488401148c8c92bf9f1a84e830202ec8f481ea85e5ea66ceac6a53343ce7454ca20312d44122863d2a35d62bfabfde99a7175f418d07eae
SSDEEP 196608:GIriUd3n3NdrYv9Bj6UxxWh//dVUiK+rviQJ6AqxE:GIxdNaBjjxxWLLraQOE
TLSH
T1068633AA7D1F0DD110045F4269985D3CFAB268D2D2189822F23D7A2F4E336399D77CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8005.msi
- Size 7.7MB
- SHA256 627c53c6769a9b4760cf8c4b739eddb213eb5ab50f4e8fae89a8d1261721c285
- MD5 a673698965536805238ca1026aa9f594
- SHA1 03743c9384fc6dd389e0c4825fc0b9f150cdd889
- SHA512 75ab04f19d855c767e3c4673f13c5f8379717a92445ccf6aedd8446f4d43d1e799d517f12b98ecb3beb57966af76324f1795906393539f2ad11cb467c16cedc5
- SSDEEP 196608:ZBN9uhdNnvrjJElzusmWA1lB7kwKCtjE+Fc2GG:ZBajlEeW2nRo+5
- TLSH
  T1C68633D67D8E1BB0C157CBB04246793CBE693FC1B6A68C12B36839141E337269A73758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2