7a4762330ad7793819bffcdca46d7d69c6e65b036aafc68c480a7ea8d2387acd

General

Target
7a4762330ad7793819bffcdca46d7d69c6e65b036aafc68c480a7ea8d2387acd
Size 7.3MB
Sample260731-ec89lscb99
SHA256 7a4762330ad7793819bffcdca46d7d69c6e65b036aafc68c480a7ea8d2387acd
MD5 1a00eaa590b1e1cf2db02c28d26e9c0d
SHA1 1720f8c558f87fbcb5d13db253aac28bba495795
SHA512 8870262421cbfd76030b568c639b796aef8adfad045c781563f5b4cd3688e923fbfdc16662e391b34933b1da57d57eb1e4ce6650231b09862aca432319d48f42
SSDEEP 98304:AS+LaQziiR5X3DajL8cr2kj8XVof7Tsv8p4ZH7OK8WkbgadjIKbRStKGpNL:yHR5HD2aXg7Ts0GVO1WvaOZK89
TLSH
T1CF7633D9E449298939237A647ABBB3589182CFF108784DC5527FC1DF60F886277E90F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal005.msi
- Size 7.5MB
- SHA256 1019b668c50c8a9b44fe2736fb7478471a79e48ecbf5d3a55e60a4e7b33f4709
- MD5 7aafd69dbd8a74ff9bcfa537704ef81e
- SHA1 924e23eb869aba2e2f96ccd11acf7962df026373
- SHA512 a37470b24e886342586c96bac60cb031abc1d08da07ae1cdacd3b61b707a75fa67cf49923c276c6d3cd54d108d3f5237aada02bf566479570e1670c291f7d662
- SSDEEP 196608:8JDpXvRhLBR/nDU6WVC2zFbP8B0FgYLiKs:cDp/RNBJnh/2zdP00iYuKs
- TLSH
  T1E38633C5BCCA3BB5D053CBB4A59272AEBC187FE4BA728C4673D972085C727262375244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2