314caa63a8d46a6a9c55063dac5979af236a4dc44c36ebcc37e50f810a159971

General

Target
314caa63a8d46a6a9c55063dac5979af236a4dc44c36ebcc37e50f810a159971
Size 7.5MB
Sample260801-wt5q7aeg35
SHA256 314caa63a8d46a6a9c55063dac5979af236a4dc44c36ebcc37e50f810a159971
MD5 5dfe3c45e438ae853f495508b467131c
SHA1 6537734f9d2e2220f5191096813e90d5165ffe2b
SHA512 4ca6fa81bcd6bdb9205e6b97db65c1942265685bc75f425ab1d021810ad0168141982f639678eff514ba3ef96b55c40b5773f043bff241579df80bf0435be7f0
SSDEEP 196608:pkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOk:p+eAAUDCYlMKqPzvO2O3
TLSH
T106863383AF6F2181DC383D827E2CAD358E9F75D24B2539262846BBDD9D044D7512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 146c96b01e4e0951d16116edb31efcb4712f1fd9970ff5eb5596314e4143917e
- MD5 cf9dbfd2e82dd5b5c8e888e89fade0ba
- SHA1 92e51a8b0be76f64572013a77fb96d918315f7bb
- SHA512 6677cb580643f00e4be8f42814967d5c5cc2d70d9000a06c1be8aafc4db805ed433b56d684c05396c765de26511dd3851896c6381ebf6d9c50d5d26349e8ce11
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gZ:IA8oKhVeLwUSPVjqSwU
- TLSH
  T17E8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2