eed63ff610bcc2774842e7b0e946dcf4a35afd66acdcaeeabf6bd7bffc71a13a

General

Target
eed63ff610bcc2774842e7b0e946dcf4a35afd66acdcaeeabf6bd7bffc71a13a
Size 6.0MB
Sample260803-elpassyapc
SHA256 eed63ff610bcc2774842e7b0e946dcf4a35afd66acdcaeeabf6bd7bffc71a13a
MD5 ade35ffac3121387c6d84a33c771be5e
SHA1 1f6d7ec7f286c3249bcbd1959a10a7ce12cb2f78
SHA512 8a51382dec0d77d840cdb6e31a8450a6ed5339794974673cbf6121e671a56ac0a33ae0643067e5eb815c562cd1c5a1ce48866bf261dcb745afb5833407ea6e3b
SSDEEP 98304:1SxiaNe3xPZJoIhXOkf9Xpv7zcEv3tbmxqWufhnYnQrScTSF5Mf75XO:gexPgIhXOk1pXdbef2hnYmY32dO
TLSH
T146563386D79882DDD867C7244D3964F4BB01AC2EE807DA04D886AFFF6349F8D949C0B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr011.msi
- Size 6.2MB
- SHA256 58aada528a0a73a06548d41bef3d6585bec71441bd7aede131b836209624ad53
- MD5 7e5b705a4cd1047f04a050131647a5ac
- SHA1 9a82125ed27e4a45fe37ead9df27ebc3ab36e524
- SHA512 a8f0860ce25553badd3e9be35c5662beab4451b3771003d83183dc8562520b6a5c6ae86fb8d7cf31369b83058a0afd612b3160c9b0d0f24d102613004923dc46
- SSDEEP 98304:6aIUmIpe1TLx3oIhj8khVyCMmuvDx90bmZeWzvhYFOjoEd8DhOn9dLJ:68OTL2Ihj8kHMmuvDL0bSeMvhYcm9sxJ
- TLSH
  T1476633C5BDC923F5C05BC7709A2234AD7E29BF58FA234C0ABA897E101F76B051778295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2