73db2dc8206bbfade7d610fc9a8b619e9314d4f3df9aac41e5f6fccacc0f0681

General

Target
73db2dc8206bbfade7d610fc9a8b619e9314d4f3df9aac41e5f6fccacc0f0681
Size 7.4MB
Sample260802-dl7ayacd36
SHA256 73db2dc8206bbfade7d610fc9a8b619e9314d4f3df9aac41e5f6fccacc0f0681
MD5 b3bafd7a05cd814e0746ce9430cd5075
SHA1 2264c57151323566ff8430a466ba8d32b6e83ffc
SHA512 6fbedd20f9ce8acbb08e81fc7fb1496d8eef8405a1ad587e320f7862ae3211d30ffe7ed2fe44af8ee1a4b6c5d80ea45192f72e39de5f455c372610e18565b32b
SSDEEP 196608:bUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAlN:m//aNFSOaGU4BPHn1BfN
TLSH
T1BC7633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 ae3dd3a9a10c8e19d870503c1eadc4def04cd6ce3d0c994514b7548ccbb82e89
- MD5 2dd5c493cd44746d53a3657b8e4ee948
- SHA1 446e6237e3ce14efdd5e191954b66f12d53b5188
- SHA512 9116987ee64079f4cbeac51b4270e16b862615d7d82ff2f55355db0a5539bf9b7419dbfa1a1725f569f2f85dc3e3aa183c26470a2740555218467ab67d8946a9
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eulZ:0hjaxXQcWaSnZNZHZ
- TLSH
  T1948633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2