bf8299eddbcd19fbfd0a461d56244030b6231e64a5566928c761bd520b8994ec

General

Target
bf8299eddbcd19fbfd0a461d56244030b6231e64a5566928c761bd520b8994ec
Size 9.8MB
Sample260802-gzqrwswemb
SHA256 bf8299eddbcd19fbfd0a461d56244030b6231e64a5566928c761bd520b8994ec
MD5 2f4d07332cbc7171f415650e8786ad70
SHA1 d703a8dcc3762f0b581320ae723c8f8444ca284d
SHA512 13c3fb4af557ea33bccc47d3c24a77718d67959287a1142f1f566f9bd8532b3403ae92bb64dcf12b14598ba320bdf996d7cb81c26fdeb68d24f43abb1a42da96
SSDEEP 196608:MQkmowxlA96i2e3HkFK6ojQts0MibTmwZ5wwdzpLoDl3fxBRc0c2b9:MQkmowxl+6it56i8ssT35wwlJMxfxBRR
TLSH
T182A6335A60AB7DDEA81CA23A74A5203CD04E71EF952AD05C7A5F8A3D4C35C04361E7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up011.msi
- Size 9.9MB
- SHA256 b316522b0ea4a31ac3773fa8db75cc0b217f2ee8e707e48af4a2cd3afb246cf3
- MD5 2f638266681347029b3c45ebee9d3294
- SHA1 bfed23ae064dcc249ab2f6934fc2753e0e13a092
- SHA512 b74778bfd8480381a3e572e83dad33119232b5bc8bb55b0046e0784799247ccddd9b3216156b0bfb26be4e663bdf946fe08f07f295efae02ffc7761209e5a9eb
- SSDEEP 196608:Jnq0IxnO7+a2AT/wFoqx+1rLYAY1tTSCRJc4fbRLIlqdbHRh5fklV:Jnq0Ixn8+aplq0wZTFJc4DxWqdbz5I
- TLSH
  T173B6339675CB2772D01FC3345587207DB12D7FD98E6A8C0A3AEEBA1C4C32514667A38E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2