bca153ed5c432ce27e1c97b0f9aec1fe9d0d3377aea0b5dd8394af2f9350e4ed

General

Target
bca153ed5c432ce27e1c97b0f9aec1fe9d0d3377aea0b5dd8394af2f9350e4ed
Size 8.0MB
Sample260730-mry17aga73
SHA256 bca153ed5c432ce27e1c97b0f9aec1fe9d0d3377aea0b5dd8394af2f9350e4ed
MD5 637ac20822d99da9d5896df94d490939
SHA1 8e78ed9d74d61d6355fc296643c309a7ca7d4b37
SHA512 f94ec63888abe0cbcecb724d098cf30e51ab60ec6e33dc09da1c6a7508d78d5caa1778d09374d48e1c8b92203503cb601a1c69afc887c29275c636303181accc
SSDEEP 196608:po9i3h3RfTuWjY8FAxju7PIsxozD+HQt82mfidHFTHg80W0:R3h3RCWjY0Axi0QozKc8Xfivp0f
TLSH
T1F38633D31F496948ADF726B3C236C9D2E86748105416FCFD4D12062191E36E73AAFBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_30v8013.msi
- Size 8.2MB
- SHA256 fe2a2727b4a74c3f5b0e1aea6eca741d285a1b7ef9574244792c6782219d0ea1
- MD5 25cee299820953bd51bcff636c3e202b
- SHA1 a94c68c064709de088b64d9674bd5e1ca4bde6f4
- SHA512 dabcb7319a6040db19cf317c3a95bf31aab7ce84d6ea3aa3d70852e8e5d07a72d3224c92c8deb31e445155cb4606ff847518f5047bdf724016ec16f5245bd433
- SSDEEP 196608:byxihcXiX/VIAjY2Dyq6s4szfonC7E+CrwT7hzFmbwsQ:bs96uAjYGyq6rszQCEvrwbAu
- TLSH
  T17E8633D27DC93770D49BC3B14123AAADB03A3FC0BE368C5B67993610597362365BA742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2