1205795c1da8677d00cee16d13f3d565b5d5a03aaa21d2819204f4262fe3486d

General

Target
1205795c1da8677d00cee16d13f3d565b5d5a03aaa21d2819204f4262fe3486d
Size 4.9MB
Sample260731-feba2ach33
SHA256 1205795c1da8677d00cee16d13f3d565b5d5a03aaa21d2819204f4262fe3486d
MD5 069cd3ac8ebcaa617f663a152a987568
SHA1 62ee127fc8b1c8dbda7628b47acb634df6a147a4
SHA512 bb2115e5576a560f17262570345f43b525029ef4c0f0da5a80a5c2bfd19897ce3852acde7e3c02c6107b6febd8f9c00564b89020827b85f5fe716b1364b5ab9b
SSDEEP 98304:kFsOUW3UzQFdH1yMQyJTZEHJQkXP4QeMb6iHa5yY0WnNzIj8188rZzxw:kFs5rzeBkMpFEpnb6tyY0WNzIj8188tu
TLSH
T13C36338698672CD2CE27586D7C52FA1F3C0FDE4598B414BA623175D37896AF1E02B2C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal006.msi
- Size 5.1MB
- SHA256 fdbaba04a1da865ef4305bb8b1b64a0a9a0732ef0ff5359c5f7cf72cca55fdb0
- MD5 cec1207274ecc76a52aba99637226397
- SHA1 78fd21f7acb573467086a4a97021e93a9dd7c666
- SHA512 eb6d15ea24debc41dea54e1371c5b9b22a9de0b8c08e11e63bbe242c6f0048cad4d1b3d1c530371b1e2a4f05ff948391f4c1e88da89ac9a3b123965a3319b325
- SSDEEP 98304:rgfcAQ/XHzG68of3LsfbKk7l49FRy5lgX9/nMM6VREBwlU2rZdtz:rg9Qf66f7sTIFRy5lgPMMgREBwlU2tdZ
- TLSH
  T1F83623C9BCC93671D147C7B56152B23E392D7FC2BE624C1B36687B441EB2636A036386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2