edf37a20ac5ec4c5b1c0d427b83995e2f0b95a059176fcf3de6d94013d6e936d

General

Target
edf37a20ac5ec4c5b1c0d427b83995e2f0b95a059176fcf3de6d94013d6e936d
Size 5.1MB
Sample260802-jk9bsseq5s
SHA256 edf37a20ac5ec4c5b1c0d427b83995e2f0b95a059176fcf3de6d94013d6e936d
MD5 aa0f2ba91936ea45c57a53babbf1b2d1
SHA1 b0df74b0c3bdb451cb4225115bf0311fda0a818a
SHA512 b0c2d4e7421b559fa52b2cd4022d6a85d2980e66bc5fd7426703932ac060ed9d7640df62d6cd0c13cc476ed2b2f218ea44d6898f7d8113908bb15822c3c86e74
SSDEEP 98304:/YtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3Q0:QtfP2pwMDfuy5JXJB4t+rBoF4jOfjLRf
TLSH
T10C4633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FAE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 6944940ea248e704ca548d805c66cdab493340461c7523057f4800135439fbf9
- MD5 eb61ab5be4de34d69251ad59d08b3d3c
- SHA1 f972afdf0a64bd1be42a97df8c5f9f10e0e28adf
- SHA512 2877b2cbf81d5c2af052fa18c3768c1fcc5264106ddb7a0db4b7607f74d417020c14ca993d0be4f1d9d9a8c808f1f079884dfde51438493e584032998f4b11bb
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3uR:atP2Ao5159L8gvmy//lLnP3c
- TLSH
  T17E4633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2