fdad53be9421c37e9904ccbf9055baea22e00b1951f932c3fd867398028450e2

General

Target
fdad53be9421c37e9904ccbf9055baea22e00b1951f932c3fd867398028450e2
Size 5.7MB
Sample260731-b2evhsag77
SHA256 fdad53be9421c37e9904ccbf9055baea22e00b1951f932c3fd867398028450e2
MD5 dc4ed1ea9a6b2c39847384a6d995b5a9
SHA1 29f18c7f28d686279b7133a443fca61e91d3fc1c
SHA512 8bee81fef1c7dbd1b07afa38223e40c74c3e3733a853dbb5ed33dfe03afe80796ed822d35ef69f7eba91fffda0f3a304f7260c25f3b2764eaa079bbf741cf7b4
SSDEEP 98304:4pk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZ9:4pQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXB
TLSH
T147563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 0bd04c55c22f8d1b9bc8761c5c83d1a05ed7bc619cacdb8989334adb3bfe7cd7
- MD5 aa3da0996c9db46c3436aa12fb66d57d
- SHA1 7781e2aa3082f6fdee17a037f93da8aa71914261
- SHA512 2482a3a3fc94ac6fce2480210f227158c70b98b01c6602277bf0f8ba033f2416c8c313c142196eafffe20d8dc999f43aeeddb2a1a9b409fa7957fc5debe51451
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRg:3yOPsdq1N9vE1bPEiGut9HzgcPGY32Ku
- TLSH
  T1FB563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2