f244f22f02882810e6f4d2f6bd2a4e96d70cf5802d2454498b2ee078eb9bc3d9

General

Target
f244f22f02882810e6f4d2f6bd2a4e96d70cf5802d2454498b2ee078eb9bc3d9
Size 5.1MB
Sample260802-jn61vaer2x
SHA256 f244f22f02882810e6f4d2f6bd2a4e96d70cf5802d2454498b2ee078eb9bc3d9
MD5 c1f36b6859bedb9975d7a3ff8ada9464
SHA1 eb5330e4665f275e58c40b4445a58de168bae366
SHA512 e0959dd9e14383f6d3be793645d435922b400749e3142cff30ad7d825ae221c7dff374ccdf7bb477908f65af605e68e0105256047fc295144b2fe8539415fb62
SSDEEP 98304:AYtfP2pwMDfYOKyf5JWqdbg6qgkBkBr4nt+NeK5BoF4j+spCfRvhLnlzfR3QV:ZtfP2pwMDfuy5JXJB4t+rBoF4jOfjLRq
TLSH
T1A34633C7B188228D450EAE0DEC0B61C961C7662A52ACD3FBE38F454BF43965CD7C6678
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up012.msi
- Size 5.3MB
- SHA256 c5ca70738bde180e473b638fe31a78d651bc946b4d8bce01adbc2ba4668c7800
- MD5 b0ee3f4da62aefd767e44f07c93a91fb
- SHA1 ec60d08b0340f8afeeb9c55e23f4fc46599899e4
- SHA512 11479b7783611668816bb8d86f524a1a5daca02a1218675c8cd21601d9159c9e18b00b118f2ad7d88a93bed8076f1cfafbcfbf9084c604dd06b74f4ea7dbd38a
- SSDEEP 98304:aVK8PysWY6KKv51IQ/bw6+wov6LDo1gz+CPxi5MZ9x//5jLprpfP3u5:atP2Ao5159L8gvmy//lLnP30
- TLSH
  T13D4633CA74C83738C08BC7B6454365AD762A3FC5BB768D0AB79D3A016D7272902F6385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2