368950513e5d334d78400a395a77388f53b7cd48c9d6135c4b6f9ad6d3cc1d57

General

Target
368950513e5d334d78400a395a77388f53b7cd48c9d6135c4b6f9ad6d3cc1d57
Size 7.5MB
Sample260802-cn82wasckf
SHA256 368950513e5d334d78400a395a77388f53b7cd48c9d6135c4b6f9ad6d3cc1d57
MD5 77b55fbc32475bfd39a48cc9563b169f
SHA1 9a695217023a772499d0e4f9995caa09bd8a8f57
SHA512 a3428bcd8e2d8e19503e5eadc78a8bbfd50f6ba4b4a6b42870d323dfd512054f251ebe8eb2d7d9f05ae2fb6cd98b8ff4cf7cfd3085128834022ee6319134e348
SSDEEP 196608:WkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOM:W+eAAUDCYlMKqPzvO2OV
TLSH
T199863383AF6F2181DC383D827E2CAD398E9F75D24B2539252846BBDD9D044D7512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 53471a3f0dfad2a89b7a69b965f6e6892033bfd1baf3e5c05e0939eb3868e7b5
- MD5 2a728d40aab3b340dfd810026e0654c5
- SHA1 55b80914a6089532272bb7b7cf7cfcef59c726fb
- SHA512 c5ddb4addf963a153f0670d9c8aa3eb25a76edda259ccd91c319e284c3481dc073dc644146aa8a7d26065f7015c68dd66f06a41a9f7710f3ee0024fdf41bd883
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gS:IA8oKhVeLwUSPVjqSw3
- TLSH
  T12B8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2