a32ed1f6dba2dc2239de347b55c160818da9ec1c8040068cb4dc8a1b0367be55

General

Target
a32ed1f6dba2dc2239de347b55c160818da9ec1c8040068cb4dc8a1b0367be55
Size 9.0MB
Sample260802-empb7atgqh
SHA256 a32ed1f6dba2dc2239de347b55c160818da9ec1c8040068cb4dc8a1b0367be55
MD5 f99e5e571bd873f095b015af06873d1c
SHA1 6c79d19d753bfda09585b416df3e15f39dd1f592
SHA512 a97b7e98842d93888208e3a356fc49968ab874a77a19d2cbe52bbbd0894bb475acfb08c3c10e4cd84bdeb026d0a1f3825b06032928dc3ffabb965168ababb354
SSDEEP 196608:gFTi7+2cs73otZiLDKnRxo5JirozsMHhkizS4C/x85Ip:Wu62f783obi+fHWizS7x85+
TLSH
T14D963385046E95A1DD8FB99CD32A7D3D93901F74FF92C1DA42CD88273F029006E6DAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_pr0j007.msi
- Size 9.2MB
- SHA256 217df033fcaaefb79111ac1129ed1f9ec372ba08bb17ce208dba5dac17e827b7
- MD5 aba5b75a9a9549ace812446f0ab25c4d
- SHA1 db008cc1dfa0cf8754eaa7d8dea1b1a5ef7f5d9b
- SHA512 5b5d03000e8745797e1e407a9be12e1d75fcf45b88d4215d41f7eca15cc8a05401e98dfdaead796cddba7eab19c98ee12b90333995f93aa1a933ee6dd56e9aa9
- SSDEEP 196608:hNooDCOTdiFhQAlXukPnW5h8FsLsypz26vAB7QZF2nF:XNpTnkWr8y1pK6vABCF2nF
- TLSH
  T1D5A633C5B88A73B1C58BE3B492137F6D7D253FC5BB268C5A26DC7A003F326112679681
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2