eb4e1dbc436ee7e2ba6d2ab8e923add18145197801e370e80a34d003a8bcbf90

General

Target
eb4e1dbc436ee7e2ba6d2ab8e923add18145197801e370e80a34d003a8bcbf90
Size 7.3MB
Sample260731-d642batbmh
SHA256 eb4e1dbc436ee7e2ba6d2ab8e923add18145197801e370e80a34d003a8bcbf90
MD5 21a0ef394df5c8bc16bc96d095130759
SHA1 4b89fde34678e1c8d6c5a8602fb04160b242256c
SHA512 b172bc75137af9efbd3bc64d838d22b3e43f2f948ad402d8c9a33f877f3509c81f8ce5904ae7d4fda4dba1497173594a86d210ecff1ed8ead20f3b8e6da7fff8
SSDEEP 98304:HS+LaQziiR5X3DajL8cr2kj8XVof7Tsv8p4ZH7OK8WkbgadjIKbRStKGpNuJ:JHR5HD2aXg7Ts0GVO1WvaOZK8kJ
TLSH
T18E7633D5F44929C939236A647ABBB3689142CFF508784DC5537FC0DE60F8862B7A90F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal005.msi
- Size 7.5MB
- SHA256 a28f7d9c69689e1679cb72aff40c6b196012e59b6298e62716b790ad7930803c
- MD5 53fb2fd1632e6e2821b0533d56618add
- SHA1 d07cf27c6cefacf155a0523a5285b1f660899b60
- SHA512 672d42069367715dff47a9c426801d3a4e708e1002425ee57391b106101781704e268146b01ca2cb69a97603ba6bea976ca5043455617a6c02c4aa3c6ca86a83
- SSDEEP 196608:8JDpXvRhLBR/nDU6WVC2zFbP8B0FgYLiKJ:cDp/RNBJnh/2zdP00iYuKJ
- TLSH
  T1DD8633C5BCCA3BB5D053CBB4A59272AEBC187FE4BA728C4673D972085C727262375244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2