a898388628ba4d167debc20970980e6466ff9ac39b666a4a26ec6738ccb6dfda

General

Target
a898388628ba4d167debc20970980e6466ff9ac39b666a4a26ec6738ccb6dfda
Size 5.1MB
Sample260802-jkvteavycz
SHA256 a898388628ba4d167debc20970980e6466ff9ac39b666a4a26ec6738ccb6dfda
MD5 554df70b2d128c80ef2a04ba476769bb
SHA1 440deaeb4d87ff9c2bb5111dc396693f9c17e3e8
SHA512 a2f4172ca1c4b9eb905a9ec79b0575867143c86f536bc90bc397fd6265d97e31f8f31d7cb0e624d0ef9ab24e07b7cd63836283bf87fdcbed37197fde9029ec53
SSDEEP 98304:ZYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3Qq:StfP2pwMDfuy5JXJB4t+rBoF4jOfjLRV
TLSH
T16F4633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FBE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 938ac93561844e239465632d57b62a7b8885fa0a783cfb37d3d3c95fe9cda75d
- MD5 1408ad80820ab8342c77fe68c6db522e
- SHA1 2b8dfa535797d570916a831bf9851790351e1654
- SHA512 b38675915a780ece0dbf68c376e6a7d3c930409fe0b4a14614082d4f73afd5a3e305cae81d848f46d6cec26887c7dc8b467dd7f073c9cc15cd23d4c042fa5c7c
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3ub:atP2Ao5159L8gvmy//lLnP3W
- TLSH
  T1A44633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2