0d763badacce26cca09d044a9fa8807072baff7e665626a9d4c8dc19f38d4eec

General

Target
0d763badacce26cca09d044a9fa8807072baff7e665626a9d4c8dc19f38d4eec
Size 8.0MB
Sample260731-mxv7gs1cqh
SHA256 0d763badacce26cca09d044a9fa8807072baff7e665626a9d4c8dc19f38d4eec
MD5 95c4339aee1bd16aab21c328daa86159
SHA1 1cde2905c860b9eaa3016fe9f0a007843701a3c1
SHA512 c8ae377c2783e759fe5bda0ac70b7ab7b8f54ca91c5e56caf7bbfcaa9fce06590a4a64ddf68db858cb1d03f67bb5e200057fa5cf18c34db8c83599904d3ec3fa
SSDEEP 196608:Il5+mjlRy9fBQPWzZuM/07fEnslEuA2kc0n5YQvtkB:IqmjPyJPdM9EuJ01CB
TLSH
T13086337E77845A0292D729DAD313E43D445BEF38AB8827BB766B50C05852202FB1BDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_mal010.msi
- Size 8.1MB
- SHA256 ade315680071e86ff610d0e11f97042245ec40d3f31ec4eca6a970e84861b0d2
- MD5 e99952c75653f96fb1354f61214485db
- SHA1 bafd440d472b5043011ec6e6b0725009fd7dc63f
- SHA512 e2b1e1b486aa279cf92aa3e6ba2b80f11a1a332b9bd8387053c1617e10b0671fbc4ed2e289cc53ee37ca86699725307de2f21e60f28b45c0f52ce201613dade0
- SSDEEP 196608:5bEhTX31Zyl79SVaDLG+/nRlf3C+8C+4DwWo2mAKtH6s7JU/r:5AhTX3vyZJnvLfSGtwW9KpO/r
- TLSH
  T16F8633A9B9C51B32C097C7B18153A87CBD1E7F61FAA64C6B76CA75001D323126F37A84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2