f235b58d7a0b26a9398600c897227ea2884343b7aac146331baa02c8f8ea0c40

General

Target
f235b58d7a0b26a9398600c897227ea2884343b7aac146331baa02c8f8ea0c40
Size 7.5MB
Sample260802-ba1mxa1dpd
SHA256 f235b58d7a0b26a9398600c897227ea2884343b7aac146331baa02c8f8ea0c40
MD5 15a7e99d3391317fd6e3d3386fbae1f4
SHA1 5b8772c2a039207a16a9e2738538aa79277f7679
SHA512 04b30f39f3cc0dc828617f0313bc9f6d69de0ae5b850ef00a179fad59ab4826bb3057de5eea754b1750d20255d15827eb640a521a365c6f45b92a208c997edee
SSDEEP 196608:PkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOI:P+eAAUDCYlMKqPzvO2Od
TLSH
T183863383AF6F2181DC3C3D827E2CAD358E9F65D24B2539262846BBDD9D044D3516B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 257e221c6b521809e4873998b971ac3dc0a599182c6ac299cb924e706a0675b1
- MD5 c097f3523c63d65bc54315a7506e099d
- SHA1 00029ad634dcf8396f899e30907ded91992b1cea
- SHA512 d2327fd184d75de7ac28af7677951b164fa9fcac5ba69fc30f82f96206e4bbfbbe61f4e2977ff00c540c042e8ded055f334f16a5ee8a91c7e0f480f2a22cde2c
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gA:IA8oKhVeLwUSPVjqSwl
- TLSH
  T1098633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2