31b4db797b16ceddfc08221beeab07744082696576d8ee8d7ceb37987b983bcb

General

Target
31b4db797b16ceddfc08221beeab07744082696576d8ee8d7ceb37987b983bcb
Size 7.5MB
Sample260731-c8qq2ahr4s
SHA256 31b4db797b16ceddfc08221beeab07744082696576d8ee8d7ceb37987b983bcb
MD5 773c1158405b5f911c1d948d0c1a5b15
SHA1 e5b7d3859065c805fcbb58a2bb09321697c2c101
SHA512 36c3d4dd21d7d446d2b86e8bc9a83346d896a84ce826345eb8c767ae011f35c363fed0e5235ea4d19e4107d04bd9822407155348648ed23aa830b4d8db4ac2a5
SSDEEP 196608:ia3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbez:JuqWH5G4cf1KjOwIs3bU
TLSH
T1F78633E844EDD198E3B176C64B83218D3F39E2A3538DEFAAFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 1aa5b8685fec0d8de49eb2059e2cadeb56fa9a6a32b807e7235f12afb117c132
- MD5 290cd679b67d90896027be61b57bb4eb
- SHA1 0a08835724636582b033b667d9f0e8b8a55e621a
- SHA512 30326cae7b34de2ecfdb779cfe016f72efb012d31ea962167e7be73a541fcfdd9a0a7037186edf05f58c5601da9057bf47ea0f879a4a305a4a2261adbee205cc
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEa:yPKfBIe9y66qJ4CYmzr1
- TLSH
  T1C68633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2