0fd63b3ae8763787fc1702bf8e4c5f89f4bce56b265b5e1fc9648f1017c33e6b

General

Target
0fd63b3ae8763787fc1702bf8e4c5f89f4bce56b265b5e1fc9648f1017c33e6b
Size 7.5MB
Sample260802-cltt6sbg42
SHA256 0fd63b3ae8763787fc1702bf8e4c5f89f4bce56b265b5e1fc9648f1017c33e6b
MD5 7696763cd3475552bd9116c7c353a126
SHA1 b1c0f16c205d74ef42387d3f5df85fd4ae34234f
SHA512 84fdd6d9f86d8753fee813b9eab077fb1ab3a4efe0bdd541ca3c5b268d9256f3eac0b81baecb1113db6197ec5899bfde7e0d7cfbc5d204f7e7fb78c4e84e1f3f
SSDEEP 196608:+kxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOp:++eAAUDCYlMKqPzvO2OY
TLSH
T1EF863383AF5F2181DC383D827E3CAD398E9F75D24B6529262846BBDD9D044D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 23cbdccf13eaeb5f3795133dc9097fe73bf0fc7a39ed696a28c7496468fdfc9a
- MD5 1197f06cc88eeb282959f294c9d1bd66
- SHA1 1cb76b54bd52e5d547ec042bb9f02099011eb4a2
- SHA512 827a8489c8b5f5231d841f601fb63a2a8b487d813065059dd61c0e15af585ba8912341c968213552b100c78586775c02c3bf815f352d80ffc540fdf4f38e9892
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gq:IA8oKhVeLwUSPVjqSwP
- TLSH
  T15C8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2