f8a69272f1752153a8fdea7719050c43b21bcd9ea07ba8ae0f4e464d93c7a88a

General

Target
f8a69272f1752153a8fdea7719050c43b21bcd9ea07ba8ae0f4e464d93c7a88a
Size 5.7MB
Sample260731-b2ff2stxf1
SHA256 f8a69272f1752153a8fdea7719050c43b21bcd9ea07ba8ae0f4e464d93c7a88a
MD5 d603860070e7ef5b6dfaecc2c6c6221e
SHA1 ded1bdc7a6c244491886b29e20a4fe2e69dba032
SHA512 e82a4b620ce6a572b8a804cfe96307b862c46e10ff9192c52d289baeedb73460bab94ab525be3bea20900400ee616deae7596f34cfc561abfaacd0a84efbfcd5
SSDEEP 98304:Vpk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZi:VpQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXG
TLSH
T104563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 1327a521617ac90bf9527ce8b5725c1ef81db25670d1e29ae7b50042edd23bee
- MD5 2f52f9f54f6dcaf6d08d0efdb2f47bfe
- SHA1 34442322a3afb95198e049f76e4d065f28d79bb1
- SHA512 7464b1e2ce916b2ec313a53ca53f174a82f42101ee75ddcd95b6bcef1fc4b77431f981d5362a476018f1d165968c40ed911e524d3881a4b026523d7434f893fc
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRL:3yOPsdq1N9vE1bPEiGut9HzgcPGY32KF
- TLSH
  T16F563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2