f41e9f8c55203c45077cb2d166d251b41579fa23f56a41282070c15f1e786524

General

Target
f41e9f8c55203c45077cb2d166d251b41579fa23f56a41282070c15f1e786524
Size 9.8MB
Sample260802-jwprjafd63
SHA256 f41e9f8c55203c45077cb2d166d251b41579fa23f56a41282070c15f1e786524
MD5 1ae8d8c3a31463faa05f644755eb865d
SHA1 691773ff1dccb51f24888d45cdd53d3f67f51e74
SHA512 5ea780b1cf68c3ee7f7db3cdc95304f735b08a47f72b547da91b1ce6f95d4a08f15f6ac9fa8f96d645985c705d9d50f1f5ec3e28f6b9c57031f6ad43e30c1129
SSDEEP 196608:iQkmowxlA96i2e3HkFK6ojQts0MibTmwZ5wwdzpLoDl3fxBRc0c2bA:iQkmowxl+6it56i8ssT35wwlJMxfxBRs
TLSH
T1E4A6335A60AB7DDAAC1CA23A70A5203CD04E71EF952AD05C7A5F8A3D4D35C04361E7EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up011.msi
- Size 9.9MB
- SHA256 a14e39a33ebbfa2798ca2b68082717b94e8f3633656f6e419bdc52d1e1fc7139
- MD5 1d1e52021047920007589095b80778c3
- SHA1 f889daebd6cb8dad3378434a8b3fa7ebb6855b18
- SHA512 25ea6197c8ccf0f3e06708f626ca4a589a47347ecbda3d9af94fc68e36b541c003685dd24028120e6d55de41f36f18024fb1f84f85f9a03ffa84ce83dd7f2e68
- SSDEEP 196608:Jnq0IxnO7+a2AT/wFoqx+1rLYAY1tTSCRJc4fbRLIlqdbHRh5fklU:Jnq0Ixn8+aplq0wZTFJc4DxWqdbz5N
- TLSH
  T1D8B6339675CB2772D01FC3345587207DB12D7FD98E6A8C0A3AEEBA1C4C32514667A38E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2