bc362b4b10760463b843197b441e4d2e5c1f3509bd327e57602198bfa590e0e5

General

Target
bc362b4b10760463b843197b441e4d2e5c1f3509bd327e57602198bfa590e0e5
Size 5.0MB
Sample260802-g36yaaec64
SHA256 bc362b4b10760463b843197b441e4d2e5c1f3509bd327e57602198bfa590e0e5
MD5 9786db713bd2e8ab9901feb5e06f56c5
SHA1 f7db60882a57d4879ff32376281d6d8c6ab8266b
SHA512 c768572a832edae1b9919655a6ba30cf25dff4f3e93eaa34ac1ccf8de39b3a3f155cd3ca228249e4d1c03efcb6b2ce8da40ad59a4a717fea129991114aa95b2c
SSDEEP 98304:UQ6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1ts:J6bEPlgY7fqLIg2saLu9A/vYQIYXxE4W
TLSH
T1E03633E9750F322F3057F3919A26A0D7D688BBF78065E116C585F56B8B648B13CA03E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 996b07b421cd07bb56084c37ecd2405800987dec6b0d0b9590945edf248ccb74
- MD5 46acdbbe6c6070b305d96b5d34dc818e
- SHA1 1e7620b2a0a401045bccbbce1c0b227ae8f0d624
- SHA512 eba956bda32b2f8fe9cde055056a6e25bea19c94088da1c17cba5bb818710be55c25c3cb98da68234f33e6e0f8c329622a4c0d8032c3478332b988d6758c01ea
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC601U:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+U
- TLSH
  T1BC4633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2