07a9c73a7b0f449ee02f84402883c9d6f05cfaa16d18b62f350f5691ea9d1a39

General

Target
07a9c73a7b0f449ee02f84402883c9d6f05cfaa16d18b62f350f5691ea9d1a39
Size 7.5MB
Sample260731-ehcslacc63
SHA256 07a9c73a7b0f449ee02f84402883c9d6f05cfaa16d18b62f350f5691ea9d1a39
MD5 48310703f10ae15bf37502735bee3d64
SHA1 a6fbb105bc5266331acd140ee711a105bda5c832
SHA512 f671f883a886d3612fe9dfecbce12af77d327a52e8c5da702eabce36598c9defff0a2230e774921beff904cb95a44bf765ba15b2d5b22828c8eb6d4232e7f386
SSDEEP 196608:ua3yNZsWmE5G48H/fCQ9RhQLjZQj+DE4IALirOHbe9:tuqWH5G4cf1KjOwIs3bi
TLSH
T13D8633E844EDD198F3B176864B83218D3F39E2A3538DEF6AFD6225017C953376B0548A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal004.msi
- Size 7.7MB
- SHA256 9b1a2e658ade78ec74264842e0019c1484efcb19b350aee30a8d62756c7c16c1
- MD5 3cba51035e7711dc60d8dfb9b9b3ba45
- SHA1 cf272225245bece4d22b3aeebce486dac842b9b9
- SHA512 4dc98ffc8862738fb54085d6c2828c3724d36a9dc1039eadf551be2a8023ba92bac2dc09823471f66ae93fb1831ba417f2a97ede71a76b0feac52019cd160f47
- SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrE2:yPKfBIe9y66qJ4CYmzr5
- TLSH
  T1C38633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2