eda71da5ddab461eb5f9b5427a1e981e608ffa6ff7453afeb9ec2d7ed02fa7e7

General

Target
eda71da5ddab461eb5f9b5427a1e981e608ffa6ff7453afeb9ec2d7ed02fa7e7
Size 7.5MB
Sample260731-daj19sbe88
SHA256 eda71da5ddab461eb5f9b5427a1e981e608ffa6ff7453afeb9ec2d7ed02fa7e7
MD5 f5c91ed32108cf9417e3069e429befa3
SHA1 4972c8d6ede568c09f6d86acd839167350809eb9
SHA512 48faf64ed3b8a70e69d5f271faffbad4f14a5e2e83f87bbd537601fac12f0591d7c4d9f3046e22555f2ba25a47fe00830a7b34b1dfb45c39b0b09e21997c2421
SSDEEP 196608:7a3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbek:muqWH5G4cf1KjOwIs3bP
TLSH
T1E78633E844EDD198E3B176C64B83218D3F39E2A3538DEFAAFD5225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 ca4f4a21c8e9fbdfa67897accb877d5f2fd008bfc003d5b07de6eb219ad77816
- MD5 bdb13bc1724c490545e44b65db756372
- SHA1 807dc20c29a84dd332aba5a8ac17259620191b67
- SHA512 79e4535bd646c46b60f109035e60073e9f172e92e5564ec3ce4f289d8a07cd57fadbf20cd0e301067403624fb6efb4993aa82b6e617a026d636eb38bfa96797b
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEP:yPKfBIe9y66qJ4CYmzrg
- TLSH
  T1F28633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence privilege_escalation ransomware defense_evasion discovery execution exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2