58c146c459a2397a5e689837f203d890e6d4e1317608f44326e5a89e402e5e1c

General

Target
58c146c459a2397a5e689837f203d890e6d4e1317608f44326e5a89e402e5e1c
Size 6.7MB
Sample260803-ewfreaybqa
SHA256 58c146c459a2397a5e689837f203d890e6d4e1317608f44326e5a89e402e5e1c
MD5 4d87c5486df5d0ec0738c749d03ca90e
SHA1 ed3ba615c508d8f54275cb7971455661fb51872e
SHA512 f074581887e758f9d9b784be9c94a72424818cc7d780ce2f9baa3ed6ebc718facd97227b07bff7dba5a4cbabc4e6ad2e39ca6beddc734a1c8a25866a5ba2ff1f
SSDEEP 196608:PjXTDAIQNxiE6Yk9PP55MuA3OHZapZJyWk8n:PLfAvNSNieHZap618n
TLSH
T11D6633385727AF41CFB0F9923DCEB90C9467EF2178229FCAF876F10949506257AA7610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr010.msi
- Size 6.8MB
- SHA256 0d6bea573c356522d3981523c4d66c39c3bddc65103f542a4e8f6cf499ef5592
- MD5 0ca7127bab16bb977ebce24a1312d94a
- SHA1 f913f869d914cc1e20da9d676e0b042c2155ad05
- SHA512 bdb9b111e3cabf15845eb76f75272deb8e6acb3f0d8291cd158ab0983dc64806f1d6ddaa19c6fa6a8d36275b0815f22297de76e084063e389a0e8e1f775a66fc
- SSDEEP 196608:+jh5lxqmIN1qEjEjWBS6kVsPRGVLZ8WidS:urqLNPEcuSPRGVi1dS
- TLSH
  T15C7633D179CB2BB1C59BDBB16147B86D3C2A7FC67D224D8A75AC76042E723292273340
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2