199be8f0ac6f4086cdad9073b6e2f090548210917938e07ce57db2be5e76166e

General

Target
199be8f0ac6f4086cdad9073b6e2f090548210917938e07ce57db2be5e76166e
Size 8.8MB
Sample260802-sf5x9avhpg
SHA256 199be8f0ac6f4086cdad9073b6e2f090548210917938e07ce57db2be5e76166e
MD5 05d32d3e1587e1df91e72205f781bd16
SHA1 407d3f7377ce87f32de54e71690b6e264da3dd99
SHA512 3bb912772364b2f1ce35166dee3b92be665588682bbe1734a59e688704085f2fde2b51790cf7caeaaa5ca09100542007234e7f67dc087cd7d53630344ec91819
SSDEEP 196608:RE3LoKIoDLKJHwtB7vZXwsgcdFKKoEt9PrImJEWS:O3LCoDswrkzELIf
TLSH
T1D496334993CF36A34E385DE885A8D3A35CF78EE7CA3E833A4E131545F60E9494888576
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up004.msi
- Size 8.9MB
- SHA256 f87cedfcc50816197d4cd8d0bec38c6cfcd3779f0330c77c57630a5786016167
- MD5 6c5d80447b1ca49cfbd50b5a1f7d08e4
- SHA1 8c38051ea33e141a7b79bd294149ea85106ecdeb
- SHA512 a5103aa3cb4c8acfc6ba1835303b147febe3e4795eca538a5c3cc8d1d1c0c841568bbec71c88e38708be957fe25b2702071dca0ad6a9e20df41a8c6506b711fd
- SSDEEP 196608:Bnt7riy4kJOk9CefY5O7lnf9ocQGdd6KC+Plp3GmR+Iv:Ft7rykJOk9NfYO7YB+XGE
- TLSH
  T1039633C5BEC93372C09BC7B40556A2AE742A3FC2FF3A8D166EA536047D3761044B966C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2