228916b7c36925f873eb545bf10facabdd0243e9490f344ab5a50cbd85d3fec8

General

Target
228916b7c36925f873eb545bf10facabdd0243e9490f344ab5a50cbd85d3fec8
Size 5.0MB
Sample260802-ha681sem3t
SHA256 228916b7c36925f873eb545bf10facabdd0243e9490f344ab5a50cbd85d3fec8
MD5 9cb73bdb667d0eba1e8c478a07e184dc
SHA1 ee9f7835e36f86d3e3e074040a5df2515502dd14
SHA512 87ee4b103c3ed8ab9fd14005c9094ff542cdd1416d935f2b8e34bfda85daf689e6db3774e70ec4be3ce7d8c56e6aa074af0898d6aabd3d9408d2c8a5be6f89a7
SSDEEP 98304:SQ6YIEPHFMnY7nG4qLP4IkeNNZ2G9a08u9A/p+Gh+Qy4QYiax9GOvFkFIoY6E1ta:L6bEPlgY7fqLIg2saLu9A/vYQIYXxE4U
TLSH
T1D13633E9750F322F3057F3919A26A0D7D688BBF78065E116C585F46B8B648B23CA03D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up010.msi
- Size 5.1MB
- SHA256 c415394867e9fad9b0213fb8304e91d550bbab4ac96ecd84c559f152028945fe
- MD5 bb2334746220f6d68ce1898ea7d554f4
- SHA1 ef8ba9cd572aff1108e6163955fd25c609a208be
- SHA512 947537e81733f0234fb9f7b3270dee4104bca7cc6d5e3fec07b818d350de73ac4f10a31e6aa41a4e5a005f79d90dae1e919cb58cd262c94e1a1c87d7f0777252
- SSDEEP 98304:Ov2gA9oq//FSIumBNjiM+ql9xEGJ60KgrA1xe6c0s64iUOYCyF9dYRTuNwqC601z:g2nuF8NCeEI69grA1YyYpFvaKNCdXq+z
- TLSH
  T1964633957C8A2738D087D3B0031231AEB1197FC6BE339C17BAD976198E72A2664753C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2