b6e438780591ad434142879ee9e722d2b942a2e2d537efcdb0e8f1602d62e0db

General

Target
b6e438780591ad434142879ee9e722d2b942a2e2d537efcdb0e8f1602d62e0db
Size 7.5MB
Sample260802-cf82xasbme
SHA256 b6e438780591ad434142879ee9e722d2b942a2e2d537efcdb0e8f1602d62e0db
MD5 6f12d4939435578262717991c5539e37
SHA1 3f3f4804f005f8bd3f2a3ccc9eae2379a03bcfa8
SHA512 9fc12fe880d35f99da54d91ea91211952ffc6c13a10180696406f1c20238ca8d006a28c3f23ea7eb44461f71ec7f2c418409534c321b62a3293d0067310e6687
SSDEEP 196608:qkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOiY:q+eAAUDCYlMKqPzvO2O4
TLSH
T1A3863383AF6F2181DC3C3D827E2CAD368E9F75D24B2529252846BBDD9D054D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 c006a399436855e38baf863cce8bf1f319861d2f0e089ece2d37ca418c64214d
- MD5 8e4910c0266ea4096eb282fa89a1130e
- SHA1 c74f471bcb78a3c0c41318139bc676297c1e5656
- SHA512 51f0a1e3399c2fddf70aefe0263fc52c0fdc2df2868f60ef62084cf1c5162e444b8c541893621c8c79f2a253c3f6a43e7f32117c1ea923165667a2b7ce3dcde9
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gz:IA8oKhVeLwUSPVjqSwO
- TLSH
  T16D8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2