4e2eb890dc265f4c6e70c35b33f4efc775455b6636a4b5dfd9f22ab8601850b0

General

Target
4e2eb890dc265f4c6e70c35b33f4efc775455b6636a4b5dfd9f22ab8601850b0
Size 8.0MB
Sample260730-mranlawbqf
SHA256 4e2eb890dc265f4c6e70c35b33f4efc775455b6636a4b5dfd9f22ab8601850b0
MD5 6d061088a331ae65725eea67405df526
SHA1 3f48326c8887ca6a2007636b5a0f0f5ded9cc79e
SHA512 780ca7db0e8a800ba9e2e23853d7aff87f469b4ba897e94aa77b3c64c2fa2acfc25d626ebca5c965c8216f3809b195ddc207000765801bddf1c00d794a642ee9
SSDEEP 196608:No9i3h3RfTuWjY8FAxju7PIsxozD+HQt82mfidHFTHg80WC:93h3RCWjY0Axi0QozKc8Xfivp0t
TLSH
T1F58633D31F496948ACF726B3C236C9D2E86748105416FCFD4D12062191E36E73AAFBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8013.msi
- Size 8.2MB
- SHA256 cd2c393438b8b0daf1a43340b94c8e4d60da31f488d4d445125bb6b5e6f685d1
- MD5 6bc4a8e08bd66e117961754b0ec2d786
- SHA1 80197e661b06a2e82f01689486cdd54b260c1497
- SHA512 39277faf869ccc9f5c20319cd70c30fa9cfa09606a32e4c02f47afd1dcc0d0e5bab528fd74b23922c45626a85ce89c66c7ed0070729e4f792c31efd40eee8274
- SSDEEP 196608:byxihcXiX/VIAjY2Dyq6s4szfonC7E+CrwT7hzFmbws4:bs96uAjYGyq6rszQCEvrwbAG
- TLSH
  T1C18633D27DC93770D49BC3B14123AAADB03A3FC0BE368C5B67993610597362365BA742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2