769c621bc9b37704d6cf5e57ee7cbd5e4aef690679a5ad73ffaa7233620044e8

General

Target
769c621bc9b37704d6cf5e57ee7cbd5e4aef690679a5ad73ffaa7233620044e8
Size 7.5MB
Sample260802-clf83ssbrh
SHA256 769c621bc9b37704d6cf5e57ee7cbd5e4aef690679a5ad73ffaa7233620044e8
MD5 c207ad26b48afb71050c71d73ff52295
SHA1 af8be51792035ff29f3d4f0115e73dcd3a634fb2
SHA512 a4e32305af87cff399c09599de7e2c920aecc5ef171a380af9ae0ad52f5314e63a69c7e2788e3a075909f1c678ad19662b26e05eac21853ba873dd5ae50af3cc
SSDEEP 196608:hkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOv:h+eAAUDCYlMKqPzvO2Oe
TLSH
T187863383AF6F2181DC383D827E3CAD358E9F75D24B6529252846BBDE9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 c3ed355cb41db16d598ead84e11505d8fbb02ce5dc091ffc33f24ea21e968154
- MD5 caa7dff65d68a5dc748a93bac74c4ddf
- SHA1 6f8a01bfbfbf8061f4a39e51d4846f641bb21706
- SHA512 7b81fe5d323fedf0ea7a950b0e1e6b3a65a24609e2e942530e7aa3e3c70cbd4aafacfa9cdd5b63a2be096725a276b3b5b7209e178d926169705e0279a68b5dd0
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gi:IA8oKhVeLwUSPVjqSwH
- TLSH
  T1F88633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2