6f21a224bc335c68afd4beed7f0dc27488d008e94b874d718712abca0b4c774a

General

Target
6f21a224bc335c68afd4beed7f0dc27488d008e94b874d718712abca0b4c774a
Size 5.7MB
Sample260802-mlhf9axyaw
SHA256 6f21a224bc335c68afd4beed7f0dc27488d008e94b874d718712abca0b4c774a
MD5 2aac71b4eaf0cb0246f778ac6b4755ac
SHA1 b0951c26b1ff6185a910d83a958d7b78dcdadd75
SHA512 4c5783377a1e5277f38f51f63584b3d8351f47bd614c78585405852eb9b3dc0bdee363f9c0d1b258b886f04deb9b728b3db94c849ff8a235722d99832d4898f6
SSDEEP 98304:MKxpX9m+JhH4/Su7Hqk63b0s4VnAxwBZw2CUeCb6okAsGVPozVylN:VxptNJjMT63bYgwPwqv6ok9AohylN
TLSH
T1B35633F19512DB16ED344DDE22AD2C35FBBF0A5A1AC9541F3E4DB1BA3205BC887610AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up016.msi
- Size 5.9MB
- SHA256 a1c23c56b02200c9b3e74b0eaa6b7b31b847ca2802f22a3e95feafdebcf9455e
- MD5 230bcad7b7ce714da1e68e28f670c3f4
- SHA1 2936f3e2ce61be40907e8afc7644f4ee2dea0ac6
- SHA512 96389d482ed9c5159938afc2604f9a5cc5af6703bfea7eb0f69e8798a795fc84b95066e1e0d573e64ab516687007468c1701bf8edbb1910ed1f6cdefa9eccf8c
- SSDEEP 98304:38ydOs5LFxBRSzYyVhxw7suB7wyw3b0w4mRANSFT+cmew7YqOg4GdPQtlgbk:38ydOstFrRSzzVfAfw3bz2NShk3YqOl5
- TLSH
  T1D45633E6BCCA2735E697C7B542973C7EBE393F45769A8C0B3A8875806D323015372258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2