30298e4fe7e0dcfe95d125b7105f2c9d6dc0d0da9a421c3bb0da17d14b8a7268

General

Target
30298e4fe7e0dcfe95d125b7105f2c9d6dc0d0da9a421c3bb0da17d14b8a7268
Size 7.5MB
Sample260731-c75hssbe68
SHA256 30298e4fe7e0dcfe95d125b7105f2c9d6dc0d0da9a421c3bb0da17d14b8a7268
MD5 e380a078d35aa3359e84d20b84b0d770
SHA1 be3879c9834014eaf0eb5d2bc245b57d818d8d7b
SHA512 a57666d119d5d569b5743628fe1a81066f3238797d31ee6a9e8106dc55375bec310d4e195c737bab0689a45ae6aec176d95a0cea1b9c66690d6c33967b2bc469
SSDEEP 196608:Ra3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbe7:guqWH5G4cf1KjOwIs3bW
TLSH
T1ED8633E844EDD198F3B176C64B83228E3E35E2A3538DEF6AFD5225013D953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 9547018448e9b1b72614af23c7e597c96f00ba58a8d0b57b5dec436008f92e46
- MD5 ca1b04e038c81a31d4d002148b7aeb4e
- SHA1 003404e5a18f22bef9bbfbdf7d9ea1b2935aa4ba
- SHA512 8b941a538e8baffaab36799eb223b207e92c8584521c9227d447ce5f9bbfedcb29c63e70161d9b620d0232e294db1cbcc85eaad3b646579ceb82cb0b98fad231
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrE9:yPKfBIe9y66qJ4CYmzrS
- TLSH
  T1918633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2