be16998a97e2e603c9e81ddadc5eb05233ff1892c7d85963fed07fc74c095ba6

General

Target
be16998a97e2e603c9e81ddadc5eb05233ff1892c7d85963fed07fc74c095ba6
Size 7.5MB
Sample260802-cghlcabf92
SHA256 be16998a97e2e603c9e81ddadc5eb05233ff1892c7d85963fed07fc74c095ba6
MD5 f2074694ad62bd6544b7128d57b066b5
SHA1 69d5c4b340d34c1324759cba3ee16743ab628db9
SHA512 132f7b1807f6de26b6600b94b931bfeccd617a766d79a0c0c225141004122a6d12d5aa7a80bcbd0de28d1f4aa3ee5d3741509be7c4b68c4c0e1f664a30a0c86a
SSDEEP 196608:JkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOp:J+eAAUDCYlMKqPzvO2OY
TLSH
T181863383AF6F2181DC383D827E3CAD398E9F75D24B2529252846BBDD9D044D7512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 5b9e1d900dd899f3872ea6287e0bbab0f720829d22501f0acdae01ad341c6756
- MD5 6d69e6d41eece1b5f17426dd689ae6cc
- SHA1 73d4107c07b82cd39590dcbd120bd1018b09ec14
- SHA512 90a14464d6abd41737c5b9f5dc39c13061605b49578480276d7a9f7265d7f2191f0a4523f546ce11ed8b9f6349052085cfd0818492760ac69baeb2b4cdddc19d
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gL:IA8oKhVeLwUSPVjqSw2
- TLSH
  T1608633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2