64334e91b5f93c211dd70d4235afea68d6785bb9b2118e28ac1464287cbd9833

General

Target
64334e91b5f93c211dd70d4235afea68d6785bb9b2118e28ac1464287cbd9833
Size 9.5MB
Sample260730-r2ms5abp2s
SHA256 64334e91b5f93c211dd70d4235afea68d6785bb9b2118e28ac1464287cbd9833
MD5 2ffe7d1fd6296f5dc3275a69778e5440
SHA1 dd7a277d8c7c3a12132585d897bd15738b40ec98
SHA512 3d3b8d35a859088ac38b2a27b048122e37237372fedbdba91ca2642bbdb7ee738aa1e68ab461cef08d1b9c28963890a870632aa1f6d80de2435f01702467f806
SSDEEP 196608:5VBOkn0UkKyEANd006NTKfkVnowS762QAfaZH3m2Jx8AJFk21XVK:5VB3nntyHT6NTmkVcbLkXm2cADk21Y
TLSH
T10AA6338C1D2F73285746069F7853463A5719EB81F479DC2EBA3038DD9082B6A83F16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal020.msi
- Size 9.7MB
- SHA256 21ab7803681a8cf7cc51717255b154acd8baead288153d5a200e6fe8662546c2
- MD5 f641c10b5359d770316c613af0f807e8
- SHA1 88988fd88fef35d44b77713eacd2bec11566c160
- SHA512 0fd9c3b0b72ec4b82a1a5bf664f8b290ec06184f4fa8f33379f2761edf77c4b3dbe001d2f81faaffeba5c322919362baf7e4c89b3dcf53bf400b3b4647bdd273
- SSDEEP 196608:xXCj1O0nUs+yMKOY/g5DNBYoKKn4ISmH2bn1eYwx0+hPe2/BFC:Ej1bnbvMKf/g55BvvJ01eYv+Re2/q
- TLSH
  T133A633CA3D8A2374C18BCBB4A443053E7E2EBF81F9698C1F7A9939045A737250B72755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2