ed8c3afcabb1da037759eb021845a9d73dfad8bdcfb9619e673145e7393e3bb1

General

Target
ed8c3afcabb1da037759eb021845a9d73dfad8bdcfb9619e673145e7393e3bb1
Size 6.2MB
Sample260730-r4fslazeqb
SHA256 ed8c3afcabb1da037759eb021845a9d73dfad8bdcfb9619e673145e7393e3bb1
MD5 82ab162b8506aeb6aadfc1eb0613ad95
SHA1 238f9d11793d7fdb21dc9e04afd5c348d5f1e4ea
SHA512 ca701531322f7d47b1ec4acd981f2534bb60c45696728d126ad9da75f1ea9138f073ec96f3a1fffa6702b609dd9b06b2651d4f7167059d0603fac276441b8ffa
SSDEEP 196608:698JfdNJ5vnS0Kyv71NhyuL8UH20Oq62XCFp070TpMEhNqzz:7d7UUWg62Src9EhNqzz
TLSH
T186663344139B7FA2BDFCB9872000049B10917C8BC9FABA9F5359071DBD146DCE56A8DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal019.msi
- Size 6.3MB
- SHA256 22127a760a850c167651bce7c52f35647935a0100894495e42dbe16e9e9de010
- MD5 b850d3371520b213ad17dadf7cb5f4b9
- SHA1 3e78b83f4cb652826dab88946192ca56af444042
- SHA512 8f5e8841621b17daa75deac17ae8532d6af63bbc602519ec7073e932786254d1e7a4ba425c0acdb99f830747c31727b34e02b0a80566bd9e87322ba6fd8b21cb
- SSDEEP 196608:wP77rf9zSaKyh3gfoePcwEDgWOqYkNMFDUv0z/MaXB0l+:I7tUEwE0uYkKpyBaXB0l+
- TLSH
  T1576633C43AC63B71C59FDB76501224BE7865BFC6AAB70C0B33AC3B056D3321A6635295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2