a52dbc88f633d1e315e291a5ee1a005059f247b9a55a1f6357f9c9b1163d630d

General

Target
a52dbc88f633d1e315e291a5ee1a005059f247b9a55a1f6357f9c9b1163d630d
Size 6.0MB
Sample260803-elpassbg57
SHA256 a52dbc88f633d1e315e291a5ee1a005059f247b9a55a1f6357f9c9b1163d630d
MD5 b3d8a78fb6bb1232712d3ba7e0f14f28
SHA1 0057b0baceffcf35239a71725930bd183bcb9b82
SHA512 48c5bc13b1f4bce4bd66757c7f361d3c33823cb2047b353bc95136bf8a299c3a1b5c7afa68f9a8dff3009707f66a5a6087d5000309e875431353c56ccc8c3a41
SSDEEP 98304:KSxiaNe3xPZJoIhXOkf9Xpv7zcEv3tbmxqWufhnYnQrScTSF5Mf75XG:bexPgIhXOk1pXdbef2hnYmY32dG
TLSH
T168563386979982DDD867C7204D3964F4BB01AC2EE807DA04D886AFFF6349F8D949C0B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr011.msi
- Size 6.2MB
- SHA256 88266f96864afed8670d66198f7e66b3402c52eb63f69e98e21884c0ef660508
- MD5 a305af45bacad5dfa8e315c736c2d702
- SHA1 816cb9c89b81aa5ec621658d9d026eeb15aff17e
- SHA512 5c9f5114d23bbd925209a2d59d57da0d7600d800fb22fd6b19019a05141d661337347706f232f1d53b109df08b87a1d490255cc5746a22372eac9a3422aca21d
- SSDEEP 98304:6aIUmIpe1TLx3oIhj8khVyCMmuvDx90bmZeWzvhYFOjoEd8DhOn9dLU:68OTL2Ihj8kHMmuvDL0bSeMvhYcm9sxU
- TLSH
  T1796633C5BDC923F5C05BC7709A2234AD7E29BF58FA234C0ABA897E101F76B051778295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2