53a6443821622c896b7cad297b2e07d0d05b0377f6ac1d712985e65cbd402385

General

Target
53a6443821622c896b7cad297b2e07d0d05b0377f6ac1d712985e65cbd402385
Size 5.2MB
Sample260803-eyd1laycjc
SHA256 53a6443821622c896b7cad297b2e07d0d05b0377f6ac1d712985e65cbd402385
MD5 9999588e0b010f5d7ebddab3c5f657b1
SHA1 1f60a91c9bd01e4cf74043e3ed7365b5623101b9
SHA512 e4d4f8bcb5e9783e4f22738ef0ec6920138094f7b8bdf0c5be9e8d5931ffcbf61539c039d38b3a2b4c9c77aecdec53f33c328307bbe7be372feae200a3545ffd
SSDEEP 98304:QZ/iAhCuDZWFUq9pAg04rIQM0AJ3tvpi63zsUBYm1hNwPolzyfji:oiAAn0Ky3S6z2m1h1lzyfji
TLSH
T102463365CA642387B0C561F0B7A9BCCD9E3F93129BF8E874602C576AB8B706D8DC0C55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_upr009.msi
- Size 5.4MB
- SHA256 3170d4d2f2dd7b9c155d915183d3c8da9f83e8e7f850b7caa0d2a8fbcb70d29d
- MD5 60795f89adc9dc933c7384ef56bf34fd
- SHA1 5330400dff53673011d99c4a89f2d5c8df71fbae
- SHA512 4dec142a3ef5de519a0ef233ced4de035c5d92db472584d5efba8c4dadc47e8fb6102909e709bc04dd33ce319511b3d1ad0c1962d6e9924035966987aa15da0b
- SSDEEP 98304:gIXVHPSJvYH7cfWLE0XrS20YXwuIYAH3zEJsx7/Z59rzgoR3wXp7ApG/9y/3n:BGvYH7pd08w3GsBBX1wXpV/9y/X
- TLSH
  T137463391ADCD2330E08BD3F4A557719DB12E3FD62EB58C1638DDBA2C5D3322A49B5281
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence privilege_escalation ransomware defense_evasion discovery execution exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2