ba1d03e3762e239c7e1e9a3a42f88d3088f59a8314dec48216e657539e9f3496

General

Target
ba1d03e3762e239c7e1e9a3a42f88d3088f59a8314dec48216e657539e9f3496
Size 5.8MB
Sample260803-dp4zzsxerc
SHA256 ba1d03e3762e239c7e1e9a3a42f88d3088f59a8314dec48216e657539e9f3496
MD5 e33e6c6487aa3ec6b94db2b310b6f6bb
SHA1 52e3537d876665a1190239cedcd3cb86a225e920
SHA512 d55b86fbc4f4dacc2126c14252b034c21490f825562945383bd5d0a8c431576866c2d1cab8657b48edbc571b133a4cc12513a157d859ed2aded56c9abbea55c1
SSDEEP 98304:UdxMg3rSvF1u4Z/VEW6tdzUQtKWLDwxNnckDUOufB4hrnd3G8v:UYgSN04ZStqYKWLDwxNRNufc788v
TLSH
T10E5633D21C5863A7C9F8357A0F9C21C3BA1725E016DBE20B0A40F273635DF99E9636E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr008.msi
- Size 5.9MB
- SHA256 f540ca071a3b1c2d555ec53986819ba59f83937736153527946f1a495a076313
- MD5 7096b36c38b67e40da203d9b9f49fc11
- SHA1 1eb9b85af443af041f292847b17f3ffe0f509618
- SHA512 afa41137654a4f3bf8f3bdcc2e1607e8f437957619fa8f07969d95a15e76cde1ae36043e6058f1c68d52d3d5d351515d5f7f20ad8635cc32d01489c351fea111
- SSDEEP 98304:bb0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDU:bbWNxG2T2s3uvDkhGuyuYBvFrG7I/yQ
- TLSH
  T1EF5633D17D852375C09FC3B14656319E722A3FC47E9B9C0B39E4B7142A33B2998B6389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2