845dd4b8c2d60ddb9f6daa4d86b0e3822d97025c29eb426c16e816916cd3d4d3

General

Target
845dd4b8c2d60ddb9f6daa4d86b0e3822d97025c29eb426c16e816916cd3d4d3
Size 8.2MB
Sample260802-sf97za1zft
SHA256 845dd4b8c2d60ddb9f6daa4d86b0e3822d97025c29eb426c16e816916cd3d4d3
MD5 027c03172e9b861a13feb7e4bdee7e5e
SHA1 e638fd463054471b51e7b5c8461830799ea8d757
SHA512 b13cf3dc5adac0a250efd5b4b445c7bf37964858df4977abae4be22c17f3823da77a12399c42f13a3c8fae511b9b3e3945f72bc019268fa7279f9c326d54760d
SSDEEP 196608:B/fQZlVpN5xPCZTFM7FQeBcOnovYBMwvjPtRzYw7mE845XSuIJKA/:BHWPN5xS+7nxj1Rz2EMv
TLSH
T1879633DA245A6E274C28F8BFA6732FA7453B6BE5665C43841C760DE20902683ED1F473
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up003.msi
- Size 8.4MB
- SHA256 f128bd2b6d5afcb0af3cd628358de0a51afa63ec631e3d7241f5cd3d96d59c47
- MD5 ba346b220f2e911bbd55fe80bd644e56
- SHA1 43a8ad14909ac190c9cee1864782af318adcd953
- SHA512 7ebaf498730a2041d90a796ea219ade0306b20a8d0f8f452af515463e60e5f8b63f5908b2df41ac79698ec319d6fb63601da5f598c95ea0f91095041f5d38b6a
- SSDEEP 196608:L3tXGxRc1XbK/rfn0TjVCB+u5PP3d3eyzSqQa13SqIN0WO:LtWxYSwTCP/d3sqy4
- TLSH
  T12D9633C5788A2331C40BC3B6536336AE702F7FD46E294E0A79E93A941D37723597E612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2