f3ce41bd174ef71b9000a54ff17902224711f7524807996d2558eb3b7563de57

General

Target
f3ce41bd174ef71b9000a54ff17902224711f7524807996d2558eb3b7563de57
Size 8.4MB
Sample260802-k2zpcszcle
SHA256 f3ce41bd174ef71b9000a54ff17902224711f7524807996d2558eb3b7563de57
MD5 e88ae28ec34ef314febb565a6ab6ddeb
SHA1 5d8cb1fbb3c6c5250e7d53f4109f9e6d5418754d
SHA512 46cdb09e3b8d57152fed966000c48e0fe9779a8545ab22b0d6e3d3ff39bf0ebcf3c59858203a0a13f35804cbf6cacd8037e8f8ec198c0980360c3b1001391d4b
SSDEEP 196608:Vh+6u1PIqEO9ZUJObXws6tN4XuF/qQwKJesUxiqub2A7r437xbU9/e:Vha17EO9ZUUx6tN4XuFiQwn8VP437xwm
TLSH
T14596338BB9D081BA3551FA459C349B06381035A7AF950DCAFF6450EAFCA879A3C473D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up007.msi
- Size 8.6MB
- SHA256 ab4c73214c1170bb8b42a3ab7e801a6d7b3ab5f0ed6d642f6a23f8a32f6e50f8
- MD5 d36b3110fd9b751a1bcbe12480eb6476
- SHA1 77b906ca87d5b733c63039fd2f834696200002af
- SHA512 2b73c9569a05c1b31bd6f4b03a4bf80da7491dcce8a36490730fff6eca4b795f4a1e548fb08e7e5e082cf84a1f3e6aea651695bfe9621ea0e1181118886ec2c9
- SSDEEP 196608:W6WTYIpbo0g4lvOuUdZpEXmPNkCM4X+I4Hmq+r0ARtMhnYJE/JD6:fwp/g4lvOuUdZpEXmPmCMTGVbMhnYk56
- TLSH
  T1049633C67CC52374D097C7B09823A62D39253FD4BF664C8ABFA87601AC717262977386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence privilege_escalation ransomware defense_evasion discovery execution exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2