84370c452d2c09caa804f3d4e13b6c179d4328f885bbe580bcd0371eff2c1fa5

General

Target
84370c452d2c09caa804f3d4e13b6c179d4328f885bbe580bcd0371eff2c1fa5
Size 5.7MB
Sample260731-dbg83ascrd
SHA256 84370c452d2c09caa804f3d4e13b6c179d4328f885bbe580bcd0371eff2c1fa5
MD5 8a2ce1561e9c72bf8f03913d7d2a5ff3
SHA1 ac0a9200105ec0e6b54d6d29933a8a31e37e681f
SHA512 6acfb75e3b7e00e28ded603333e6e8b619d43806a7f2651b1d0cdd79468a06c96fe8914981384c7ed06c0c8beb4087a5a528c27e22b965b7a8d95154c4c8b36d
SSDEEP 98304:ppk7orxnKPvqC2D9t2tbCv9HdDFU/Y2KTQMz9BkOfsQkGJVzaGX3K2xAKpZS:ppQ2t+vqHD9t2tbCvZdC6TQMz9BP0QXm
TLSH
T199563359A33E89E714F33FBD66858F35608EBA53BEDB890CC435AB32C514252781F612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal003.msi
- Size 5.8MB
- SHA256 46ff9f7bae7daa4043d463a91d4bde3d0a8a05a7c3c3135884dda390df0c59db
- MD5 1442e1eb536aa33cd300b03dc19407b7
- SHA1 bc16bbe0585ba5b30ea2350052f8733944718830
- SHA512 a631fa7c00007a4596998d920d0345a75d73ce8db4da60bde56929520b36079e10cf6e397ba7ea4b8dd131716e89cd70e8e405d83a54a586c66ea106960c21af
- SSDEEP 98304:3AnifxFCNdq4yN9vE1bVdEpUGoPHN9HGkZCCwCJtXG4X32KvqiHRG:3yOPsdq1N9vE1bPEiGut9HzgcPGY32KI
- TLSH
  T13B563391BE8A2B39D027D7B44696663E702D7FD14E634C0ABAFA3F1D5E323152879340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2