3130779a562d922681a0430ddb7f9c4b32f98c1e47172fd6ae239be7bc8bf493

General

Target
3130779a562d922681a0430ddb7f9c4b32f98c1e47172fd6ae239be7bc8bf493
Size 7.4MB
Sample260801-v4as5aec63
SHA256 3130779a562d922681a0430ddb7f9c4b32f98c1e47172fd6ae239be7bc8bf493
MD5 308bfc9aa942013e65674f6c0f715dfa
SHA1 77e57a05ce064c480c73a264e1d890cf497d9c39
SHA512 9854b0e934de6f114ee8a13f24f506d777141b60cb56a952e33077f8f234a71cd4ea5842210c8f17e14bd5b6773198310856cf8d36d9bf1c0f5dfb0f8c4ccde2
SSDEEP 196608:t44fhCJxaLkiZSEM/9zHjYO0ropgHhvxxLDbllIrsRRkt:t4gjoOj09zHjXyo+HhZBDbllKt
TLSH
T17B76338F6094D04BEF9364B9B7ACFBC31ED2EC8BD1E335E3B146805196538D142D89A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_pr0j009.msi
- Size 7.6MB
- SHA256 0d8d59cc705042d714c9776c72021a618e59a24eab2856d971e9a51de6a6fc12
- MD5 91c0edc86f657dc10b6cedacd30e8671
- SHA1 27cf3bb4c228f19aace3d76c46a1da7b327e1214
- SHA512 43fd64a233db054bc1f441783bba3bbf30aa89d3607c7fcd6b83fa8f9422cd422b20b5c23abfb87d144012dc65b66a7f2ff0f642014d06b53e400f83fb5fe659
- SSDEEP 196608:gGHpjjfaZTAL2KZS+E55TMdc3GQayfRVuB9Nflv3tv7IDqlRUX:gcfv627y5QyuyRUB9xN3tv76X
- TLSH
  T12886338AB8C67271D49BC3F1A246B69E3A667FDAFDB30C1776E935402D3362501B6304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2