9ba82d6c30dcf391d4d16a402aacf51bd95e4d30a5346e927723c060c7ff10c1

General

Target
9ba82d6c30dcf391d4d16a402aacf51bd95e4d30a5346e927723c060c7ff10c1
Size 7.5MB
Sample260801-xdv3gsteld
SHA256 9ba82d6c30dcf391d4d16a402aacf51bd95e4d30a5346e927723c060c7ff10c1
MD5 313cadd114d7d0310173f74b4666d8ef
SHA1 081a583b3d30212437301d9cfbd3178886b30631
SHA512 a64bf1d875fd8979ea1acd99b2d774e764a9b5d371c18d652ea51aeb27fae6f754c3e71a4069350f0097754436d53031c2e6587ab5d60ffbaebdd360ec57826c
SSDEEP 196608:GkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOy:G+eAAUDCYlMKqPzvO2Ot
TLSH
T1B9863383AF5F2181DC3C3D827E2CAD398E9F65D24B6539262846BBDD9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 a19672bbf884684afede222a1326d3cf4b370c4d1412e0965b76d36cb9ada9bc
- MD5 70b46d0d6b75f5ca900564c708307e50
- SHA1 e70556c0a221d91355c49d9750ec0e53fa1c5f1e
- SHA512 fefdb50433d6a3ff661774907e620d49f98b3e640a9fd04cedbd52e572229fcf84f9906c230787b65b2801643fa4f99adfda6b2627db4428a0607d88c66a12c0
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/g8:IA8oKhVeLwUSPVjqSwx
- TLSH
  T1A58633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2