b40fb2daa25ec68a51e5de19811ea9943570156a378f1609db188e483492c884

General

Target
b40fb2daa25ec68a51e5de19811ea9943570156a378f1609db188e483492c884
Size 5.7MB
Sample260802-mghlfsgf78
SHA256 b40fb2daa25ec68a51e5de19811ea9943570156a378f1609db188e483492c884
MD5 9f24fcec657b2b8d8a9682785c60e3ad
SHA1 1c630caa822018870e01554b9366b7a6f3f7607b
SHA512 e8cd5bc03514df02e8fe6b655aee60fb2960ec34cd6bd001c4195f8a42dd3ce77daace1cf91ab2f41174be888a48e31e3e1627ab21e1298e3d43bd86f914df22
SSDEEP 98304:dKxpX9m+JhH4/Su7Hqk63b0s4VnAxwBZw2CUeCb6okAsGVPozVyl+:YxptNJjMT63bYgwPwqv6ok9Aohyl+
TLSH
T1725633F19512DB16ED344DDE22AD2C35FBBF0A5A1AC9541F3E4DB1BA3205BC887610AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up016.msi
- Size 5.9MB
- SHA256 e632d9f28c51f335234f9c51421b4f45d55b7f49f5bbb84d833f1aa89e114272
- MD5 26a94c1c8657094d57cc8d2fd259ebc2
- SHA1 0f79c43fabdca1a7923b432e8dcf02952503c604
- SHA512 ac0a2c7e0b6aa4c25a1163d5e36e2acb92b62359ff3ef2bef162c04772707d9717c278b927709c417f96bb7e9dc51edbbd8087a4ea92a494df45d616b00e2b75
- SSDEEP 98304:38ydOs5LFxBRSzYyVhxw7suB7wyw3b0w4mRANSFT+cmew7YqOg4GdPQtlgb7:38ydOstFrRSzzVfAfw3bz2NShk3YqOlm
- TLSH
  T1675633E6BCCA2735E697C7B542973C7EBE393F45769A8C0B3A8875806D323015372258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2