332d927e69ff0bca43940a39ab3255ea6b3035077797e5442acb1782355e0c66

General

Target
332d927e69ff0bca43940a39ab3255ea6b3035077797e5442acb1782355e0c66
Size 5.7MB
Sample260730-vda17swtfx
SHA256 332d927e69ff0bca43940a39ab3255ea6b3035077797e5442acb1782355e0c66
MD5 08b3b46fd0e398456f8875e2b2e12a2f
SHA1 d5470ff640087e589c8129dc4da3a1a9aab48754
SHA512 44a83b1c14d065123b5219bc87e8bbb04abfeb07227b057e07e99d3bf50481ff681aec68c834b213bccfeec848b97bfb1d033ed4a46e9dbe1c346ea35080ee03
SSDEEP 98304:QGXDKIeTlTbVtYy1uxToM0F+XEhIZlEA8mMrPTbP+RcFh53rJrpVJbqNPEHTQjoJ:fX+IsTb7Yy1uTT2uZlEA8BPTbP+RqhBt
TLSH
T1925633367AF986B7142926F04ED9025977CB721406E74BCB236673582B8BCDE4C5B30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal001.msi
- Size 5.9MB
- SHA256 9b4b3bc9d6f73dd5529e82dd7a30c60e548160932ea46a64f8d7f3267c57dbbb
- MD5 574445ea7d62c8d2900d75fb250d86e1
- SHA1 20ecc506eae189492ea059358719a7963df7f6a5
- SHA512 28003b4eabfb9ea0a50c1c81ca772cef494c09313f82d751e449474dd3520e4792e7975901aa963d2e7b8998790f9779485c2736ccf0e77ba8d3633049e3a511
- SSDEEP 98304:Si0I8JLVbHR+y1ubTCGO3+h49k9vE+CO0hxilZxpct9FgaSjLzyZBrb/UkpHix/X:L0IWVbx+y1CTBs09vE+COExilm19SDOM
- TLSH
  T1B656338279C95776C08BC3B0854622AD725F3FD5BFA68E0F73A537041E7361A48BA706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2