ac09438055612a1f35f72e3a56826ad8ab90d40bda12e94e72ceb38d93ac354f

General

Target
ac09438055612a1f35f72e3a56826ad8ab90d40bda12e94e72ceb38d93ac354f
Size 5.4MB
Sample260730-kys3eafr2v
SHA256 ac09438055612a1f35f72e3a56826ad8ab90d40bda12e94e72ceb38d93ac354f
MD5 1a1a89fc7610b096a3762a461b625142
SHA1 d344ea9c4ba5a6db55ee995d12d7a0a8884b692f
SHA512 9e96501e24658bb4ca0943c0f8b17da6570d525fada3071c69ab560823b792b938489b195deb1dc9cfacbc6d6a3fab69bf3780b2cca666b7b97d710190cda486
SSDEEP 98304:6/16qUGOxL4pZqckkW0Bvm7oU1piBglWGU5neK1gkKbOHa+wloVxNmxqz:4P3OxkpZVkL0Q7ziBgIZZeK1gkwVlSxF
TLSH
T1FB46332BF9D293602A2F47723766F2653D2F37B97DAAE29E58090410C384B31356CB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8008.msi
- Size 5.6MB
- SHA256 6d27c3c69e723a7fe9acade38f2128d27ccb9f942f1373168a494b095c81c9f6
- MD5 0636598b443dfb144349ad0575bf9689
- SHA1 3d51d87824c6ffc494fdf9ad91b810be14ada98d
- SHA512 26617e2763998ac7fd61cf0b64eb7a7bbab0c7b5e939baab2503d5080dfe23ae4ef989dd4194e2447aec343f95e4ba6c7d5fd4d567b70322f3f69754a94074e3
- SSDEEP 98304:pQwGGOF7QjzWSm8WCJTMBucH4FQFlnyxlQMHsKB+ipxwzamC9IBbVmT4:pLJOFcjzjmzCOB9GmnyD1MKB+iDR9Mbb
- TLSH
  T19F463397BDCA6370C04BC3B2565232BD313E7FC56E75CD5B3A9935088E72A2128B6784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2