915a64cdcb40805d1fb071073995639a3a5c5178ff1c811bf997c4f837e57194

General

Target
915a64cdcb40805d1fb071073995639a3a5c5178ff1c811bf997c4f837e57194
Size 7.5MB
Sample260802-bf55ksbc36
SHA256 915a64cdcb40805d1fb071073995639a3a5c5178ff1c811bf997c4f837e57194
MD5 407b6de40d8da4ea1611607c13c1e64a
SHA1 87daea64df5e7e65e83dbc1be8e6db5fb4618f00
SHA512 d21edaa8b5fb7668765c2fdb3d36d9d30ab419a8d41f0b086924c80c5629e7d77519f12e43cb54106746de11fd171a8136eb1cdf7cd6ac6c0563f2b2f902c53c
SSDEEP 196608:DkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOS:D+eAAUDCYlMKqPzvO2OJ
TLSH
T1A7863383AF5F2181DC383D827E2CAD358E9F75D24B2539262846BBDE9D044D7512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 82052ffcb866d43deb7264734c761344c095a236175105116834a6042f6c17a7
- MD5 578fd0957b092999239a334a90d43067
- SHA1 3895f5cfcfbd8fc5bad1debcfb6113af7381344c
- SHA512 96d04379bd4c46fa8163498d25e1b7e7a5bb4f7cda7a715795222fb652f2db32444b5fe4b151022fb239a03bb9b5f470265184fbe1e485530a85d58418d37318
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gY:IA8oKhVeLwUSPVjqSw9
- TLSH
  T12C8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2