a840363ece8b2efb4d826ca2b656e5da9b3a48e00aa539fd0cbc8ef57f0ab026

General

Target
a840363ece8b2efb4d826ca2b656e5da9b3a48e00aa539fd0cbc8ef57f0ab026
Size 7.3MB
Sample260802-mazw6age97
SHA256 a840363ece8b2efb4d826ca2b656e5da9b3a48e00aa539fd0cbc8ef57f0ab026
MD5 8b9ec7464a2a63505164af4d9b24812b
SHA1 57fca21dd3016950af1cba0e1d70afe2f88bde45
SHA512 f13d40701e6987c3f126ec92311f472ef2bb742ce6629b1dc838483a8c36bfffa6d6c3bf85003fd7119d4152e268a36b14bcacfda08195044cf12e40b67cedee
SSDEEP 196608:7tm47QmBAikBHmz3AAC4zqsYb8+ji92ryweeqCI:4iQmBQmzwAZYI+I2rC1CI
TLSH
T1667633A4F1212DFEF3C70D3C29FC25A55E5EF6E5E124724AAB8F285F439949781A8031
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up017.msi
- Size 7.5MB
- SHA256 2da9d46515f4c74a147eaf71326e43bde881fc6bb66b18a7f7cc968e92272bd1
- MD5 95279ca8279ece80c034941731e0ff0b
- SHA1 1bc16dd5c85b65be24c724f825497ea9bf1b5430
- SHA512 501b13d586889dff7ee653bdc0a7eebd119c711227a6b9df840555790777ffd59d17126ff6c27c34998dc26957ec1e8ee5b6571f8cbb276d00fc0cad0ae3a34a
- SSDEEP 196608:wCSNa6LGYIbHer+PusmZqP6k3U7CFsiq6mEd:PQa6LgeaPusyqyEWCFiBEd
- TLSH
  T1207633C5B8562774D08BC734155A21AD722EBFC1DA38ED0BBFED3A0C1EB263654B5260
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2