b05677599dfd314bd58f369d6b59359815895d3b81a6c4a6bc1f9996b44671fc

General

Target
b05677599dfd314bd58f369d6b59359815895d3b81a6c4a6bc1f9996b44671fc
Size 5.1MB
Sample260802-jf1tvsxekb
SHA256 b05677599dfd314bd58f369d6b59359815895d3b81a6c4a6bc1f9996b44671fc
MD5 4dc293078dc0822f03e8a002c256437d
SHA1 bcae116ee8035afa61ad58bd1e0fdf3bed9c245b
SHA512 c5950fd6ffdb3234530164efa513cbc3d6e9a4bdf7cdf6855f6a8116055a878a7cc45ea50e59d368f4dbf33aa986f09c87930e3cf6efbad0855cd200aa4db978
SSDEEP 98304:fYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3QV:wtfP2pwMDfuy5JXJB4t+rBoF4jOfjLRC
TLSH
T1D54633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FBE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 8eef3315290588a70fb89c8e82299b246878d292b46adffe8c1e284611cdfd86
- MD5 72d74ea158fe20418ed7016475036771
- SHA1 0594d664cdf9fd3e14ffded2768eb5f5f96360bf
- SHA512 858d5faeb3b4b7f83fac12e006a820dbd30594968940283e53f74156359638aa5329d1468433f75bb1b9a6058f852f1e8265c6a35406b322ef6832a909bf6ff8
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3uZ:atP2Ao5159L8gvmy//lLnP3U
- TLSH
  T1504633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2