37818a6e8b2e78c091347875cd638de6c8e7ac4f010efeaf4055c906ed1caa69

General

Target
37818a6e8b2e78c091347875cd638de6c8e7ac4f010efeaf4055c906ed1caa69
Size 7.3MB
Sample260731-edk86stcnb
SHA256 37818a6e8b2e78c091347875cd638de6c8e7ac4f010efeaf4055c906ed1caa69
MD5 a9fc9dcfc09434e0f45fc8a7da0d25bc
SHA1 39dd8137b216ce6cfced267f099449b15dccd1a2
SHA512 65875bc0737754f5d1b949efad244826f82fb68f90f46bf9989bfdaf376226041033ce3390a1e3d103f227488d434d7b392b2087491e167d1a47e6b078b50b60
SSDEEP 98304:3S+LaQziiR5X3DajL8cr2kj8XVof7Tsv8p4ZH7OK8WkbgadjIKbRStKGpNX:5HR5HD2aXg7Ts0GVO1WvaOZK89
TLSH
T1C87633D9E449298939237A647ABBB3589182CFF108384DC5527FC1DF60F886277E90F8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal005.msi
- Size 7.5MB
- SHA256 9be450423e1d0e3f225319015e8c33b9b6127eb961943f6a0012a741422b6c93
- MD5 81422e6c59f3f2bc3091ffe7e3a530c6
- SHA1 b4b1d51247d4d7296a9140c96b4bd08d7b7c3cc4
- SHA512 3f8d1899b149e5d371007430de93babd51592db2001c67295a91200f51e32d46f71ee70878de4df1147460af851bfdfa7f8d74724812aa96c87b2fc21b19227b
- SSDEEP 196608:8JDpXvRhLBR/nDU6WVC2zFbP8B0FgYLiK/:cDp/RNBJnh/2zdP00iYuK/
- TLSH
  T1478633C5BCCA3BB5D053CBB4A59272AEBC187FE4BA728C4673D972085C727262375244
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2