ad6732a8ca819134717de471eb180493dafb8693f7d8f0183f7c2f18bda7d748

General

Target
ad6732a8ca819134717de471eb180493dafb8693f7d8f0183f7c2f18bda7d748
Size 6.2MB
Sample260802-rbzp1aba76
SHA256 ad6732a8ca819134717de471eb180493dafb8693f7d8f0183f7c2f18bda7d748
MD5 27786009e4b0c8786b6452777f8d74ef
SHA1 8ef2841824021aec64140812a528596bcfe9d41a
SHA512 82d80c6bfb9353a63ec27bb9ba51bd3487360ddafd8477088b3c3ddd66e69c24d9b914e04f49529e0fa1459550f18e0774dc21a2c27b3bbddbd89d522c4a065d
SSDEEP 196608:ZNCs0LPX6u81vGPaI7nkY1lGh/q9g3Zky9H:6sCPX6u3lzgpkG
TLSH
T1E1663367BFDE206E63F304E6FB3B35E69D385048806464FBE0597AC19E18E6C51D6AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up002.msi
- Size 6.4MB
- SHA256 29d5907536ea23e8cd2da14dcc79c6fa351bba1fe190a5617ee36af1f6756eb3
- MD5 3dff32d640d0e15e5d7e2ecc42cabe4e
- SHA1 8207abf9acfb9c2e9837812ada4d967e9e177a8a
- SHA512 2184df570fe7d3d54a204895c43f666567ddbd186186165981b60d72ea61741350476e81b5529dbf0e30fd77b47e5f09fedc1aafac5fec56bb7dda99fba0388a
- SSDEEP 196608:pvvjbv/+u8PzGJ6i7h20H00cohVnU9900Lb:ZvHv/+uJHH0fmU/0s
- TLSH
  T11B663392BDC93335C2A7C7B0951738BD7C3C7FC9BA329C56B5983A405E72B295276280
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2