5c905f68299fad07a09623ca867dca494367ef190c1d525b16f5fb34d3f830d9

General

Target
5c905f68299fad07a09623ca867dca494367ef190c1d525b16f5fb34d3f830d9
Size 7.4MB
Sample260802-cdb96abn4v
SHA256 5c905f68299fad07a09623ca867dca494367ef190c1d525b16f5fb34d3f830d9
MD5 d048b721ebca96f9f2416723c88aa48c
SHA1 9ffcb7204ff9ed1a1133e9e2ec7f25982d8689ea
SHA512 114624a173836c6231c49aff6714e99b7d6b93c7ccb11128418ac666aca7f79a3e0a85ac03b9ce89eadb1bafb09debe61bdedb5d6e0d510d574a4f3cdcb6dfce
SSDEEP 196608:iUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAlt:r//aNFSOaGU4BPHn1Bft
TLSH
T14A7633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 3da56f755db84901f99f8863058dcadbdc3b400c36b31fa5b92973d44b8f5abd
- MD5 4801bbdeaddfdebaa98df32474440fbc
- SHA1 ef4aca09efe4cbc908c2b0f99dc88d3d6c5914bf
- SHA512 4d89262752f2b7b7a0e408c8be3a17e90bc9d0ce6f4a2f0a2a6bee1de075c4d26d84985c177d9638ddf7b294cdf1297cc6563a10f1915c09186ed01a3f4d9709
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eulJ:0hjaxXQcWaSnZNZHJ
- TLSH
  T1ED8633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2