760801d802745b415b1d222994c77e9d7ed8bb4001d8cbc256b08db31652c08b

General

Target
760801d802745b415b1d222994c77e9d7ed8bb4001d8cbc256b08db31652c08b
Size 7.4MB
Sample260802-dkpdqscc96
SHA256 760801d802745b415b1d222994c77e9d7ed8bb4001d8cbc256b08db31652c08b
MD5 fd5f043a30ac6ea8860c727c99e08bf7
SHA1 108f3430975157ee05c6a2aef563f2df2c471736
SHA512 87925e0e2174aa65bb824d249c65873494cc6fc79b0f230531ac70f74f9856fdedfe8c53be0d7a9bd76a4eef2039415a63511076126ea12150e846d1b809bc62
SSDEEP 196608:cUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAlI:J//aNFSOaGU4BPHn1BfI
TLSH
T1437633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 0f222defec009c65ff1d41ceff228c4f3c5ab9f7f3877724801729ba6f6275bb
- MD5 c73794c30ea466dfbaba2affdb12b82d
- SHA1 c934c63f669598483cf0fc01182a32ecac5af91c
- SHA512 22b4cc507201deb8b5ec7525bd512995b2284dab5a52337bbdec9fa28ab1e56774260edf3e09b28f1347ff9b8851f5c9c69a88836464c1f2e97c2f7393627f5c
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eulp:0hjaxXQcWaSnZNZHp
- TLSH
  T1A98633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2