58676deb9c0d0006738c1e3c68aa6d485c5f9f025c12ea60225cc016bc2b6867

General

Target
58676deb9c0d0006738c1e3c68aa6d485c5f9f025c12ea60225cc016bc2b6867
Size 7.5MB
Sample260731-c4txwshq71
SHA256 58676deb9c0d0006738c1e3c68aa6d485c5f9f025c12ea60225cc016bc2b6867
MD5 f15a6f120eeb33f32d444f6d165a0776
SHA1 4a43fabe06444cc9faefe3aee01fe75c052752c3
SHA512 e44bdb2d0e00f9575838c97780c3794b8e7a82029e3b263c2878c6e5d17e1c3fe662ff8eac62b0bbc135743920188393a1cda51cf240dd380c9b15905d544bc7
SSDEEP 196608:ma3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbe7:FuqWH5G4cf1KjOwIs3b+
TLSH
T1978633E844EDD198F3B176C64B83228D3E39E2A3538DEF6AFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 8cea7d754959f93f3707d43d2b6b87c8b1dd24d9e7c6c6859e6bc3f5393d6188
- MD5 b82b6cfd001768874a550486ef802872
- SHA1 27dfdb366731e9e750bfa674ddef278591794a24
- SHA512 a5476f914310e8ca8667f021deff065784f24a81171aa80941d0e50e699a25d55dab4ad7b10d5b6512bf8a331ead096d2ca96e6eb07d01e03851d4e10b6f053f
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEK:yPKfBIe9y66qJ4CYmzrl
- TLSH
  T1FE8633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2