47ec10d0bf51573b646edc1b9a963ed81f200fa3e05ec45322b126f800c3c8e3

General

Target
47ec10d0bf51573b646edc1b9a963ed81f200fa3e05ec45322b126f800c3c8e3
Size 6.0MB
Sample260803-elm3qsbg52
SHA256 47ec10d0bf51573b646edc1b9a963ed81f200fa3e05ec45322b126f800c3c8e3
MD5 33041fb47c52500537cf7970bfe45257
SHA1 ae9545e2edf4fac05343917ae3c695fb0ea31a71
SHA512 23c016594c4b00979d84cfe0d8555ac61e05f14d2a471c6932ef5b8ef6a5e2de2d2ea6031d3bbf146be41d2fdf91d6f5916c18a6d03bdcde862d7d1c1dc92f4d
SSDEEP 98304:qSxiaNe3xPZJoIhXOkf9Xpv7zcEv3tbmxqWufhnYnQrScTSF5Mf75X0:7exPgIhXOk1pXdbef2hnYmY32d0
TLSH
T1BE563386D79882DDD867C7204D3964F4BB01AC2EE807DA04D886AFFF6349F8D949C0B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr011.msi
- Size 6.2MB
- SHA256 ec77962d8fc3974d174e403d5c7d26f0aac699587c76a1f84f5fdda6e44aac7a
- MD5 f35ed23ea7b933e91e39005f4a865419
- SHA1 1ac80ad15340383ee8e836d2858db9a6f2813d21
- SHA512 d533b10c85cfa09f6de018acb96f4a0aba308a83509bee59a033ef07118bdbaffa28fe1fe224af3cedf60b184f5a3409ab935cced222313ed13a589e33593eab
- SSDEEP 98304:6aIUmIpe1TLx3oIhj8khVyCMmuvDx90bmZeWzvhYFOjoEd8DhOn9dLp:68OTL2Ihj8kHMmuvDL0bSeMvhYcm9sxp
- TLSH
  T1646633C5BDC923F5C05BC7709A2234AD7E29BF58FA234C0ABA897E101F76B051778295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2