f6b8ea949bd66d2d5cd525fc1a6786254a4a73dd8bcd666c89a7b14c19684695

General

Target
f6b8ea949bd66d2d5cd525fc1a6786254a4a73dd8bcd666c89a7b14c19684695
Size 7.4MB
Sample260802-dkfftsshrh
SHA256 f6b8ea949bd66d2d5cd525fc1a6786254a4a73dd8bcd666c89a7b14c19684695
MD5 1efc807e004e6951a220fd103b49dcb1
SHA1 46b78c5d2fd7f404a14a16a3eafaaca5037620bf
SHA512 f7c147c3aae65108b265d334bb20c08db1d8ada96cfcdc993272af61a666e8641956391bd730a4a2399061a91bc3f0e1e6d0f8062ede6257f04fb993375a038c
SSDEEP 196608:2UF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAleD:P//aNFSOaGU4BPHn1BfeD
TLSH
T1017633BAD3BB3CFEC15A53110336912B6DB6A1D8A83DFF84139BC0A90155DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 33584f9ca4f3f500dd3dc9e1688a4b030ebbd33b8812638744eeed0fa76556a1
- MD5 1b664b998653b2437d02eff027ae4cee
- SHA1 4a0f14dee653596ee3d25d187415bb7a08ce45ef
- SHA512 5330b7963965c220f81fd90ff8a3cf04ba0fd6ccc097fa3df80dd9c2d0287f90c7f4b4f6a3bb0fc5ead47cb403a724a0ce76595cef4ade8eb4940a19d420f362
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eul+:0hjaxXQcWaSnZNZH+
- TLSH
  T1DE8633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2