57eef911105020c19d9fe4d4dfacb68f4c25a747dc4f7ffa17edc9de623af112

General

Target
57eef911105020c19d9fe4d4dfacb68f4c25a747dc4f7ffa17edc9de623af112
Size 7.1MB
Sample260802-fp197sdd62
SHA256 57eef911105020c19d9fe4d4dfacb68f4c25a747dc4f7ffa17edc9de623af112
MD5 3d495cecf14d777333f2e2aa8ebea572
SHA1 79a61dc5bb40b015adfaab1cfbfa4e1ba1eafd65
SHA512 da2345b23dd0135f46595cd6a41c84234c3ac8bf72b38ee509724c433e24d1e47d7fde5a71c881bbbec1c3707d36fef279a9ccef3f91bf47ab2d4664be53e452
SSDEEP 196608:eFL2wALp9/nh9/UPYjZTKJQqtvd77PWXvzRDiEyq5:qCF9fh9/lV+Cs77KDiEl
TLSH
T18A7633B57A2B08B789C9661FBB60036D12974E058CBED324DF25C969EEC1C1948B7F70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up009.msi
- Size 7.2MB
- SHA256 96b7a676b28a905ab87a7a7a8c9dc8979a9d2bffe83c1607864cd59b9b6db057
- MD5 454f9a84739ed2fa86b7caa85644bc47
- SHA1 ad2374e4b1b0366a41d95e6cf52226c21c299efd
- SHA512 87d713f2e0aebe6d9db5cb3d97b997c915d4039cae584d5a4cd221486934684b3891f5831674b0cbaf9fad250e2e19de65b0a0aad87202e478ccfaac4bc10c2c
- SSDEEP 196608:/aY+RHjtZml91O9WJw2JDv/P7pGDzHdvamCqc:z+tjtZI13+AP7Ovamg
- TLSH
  T1687633D5BD8E2674C0CBC3759401232D716A3FC5BE76CE02FBA9BB581EB262514B6B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2