fdbfe16328422a2cf94caed60fc96aa7bb08ff5d2ef4b69b5b4e6e7a940e3d22

General

Target
fdbfe16328422a2cf94caed60fc96aa7bb08ff5d2ef4b69b5b4e6e7a940e3d22
Size 5.8MB
Sample260803-hyll8adn91
SHA256 fdbfe16328422a2cf94caed60fc96aa7bb08ff5d2ef4b69b5b4e6e7a940e3d22
MD5 fb4b38ce914c767a78371a4cfd68b399
SHA1 7481f97df2947577d1820cae7fb4598af12cad78
SHA512 fb48ae53dbb444450f621bfaf35dd3c885f781508e47846dfc12a6fdc65fd0579a448aae13c42c958fbfe5e2ebd82d3d3d6729663c50b0125dcff3899aca1330
SSDEEP 98304:8qA/BoYVHx8fyEu3x+GX7xNpn9GsrRxk9PNgGgdbMbFEP4Bjiio1a/oC7cHcU4fr:8H/hPEu3FtRxkfgdKxEP4BuV18oCAHkr
TLSH
T15F5633C610AF6A85193F7296F65F4042C61A6B826412E7003E654F52ABCFCBB3CA5DF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue017.msi
- Size 5.9MB
- SHA256 26033207e1e0e872e374aa14b192a9399f47ba0a86b157638fe3e03b3e949c7d
- MD5 8f73522a7a77407074caad868eaffc6c
- SHA1 3da94c506aa0c0220388eccb62aabb8790109d64
- SHA512 eb2c4b04ad20f4695442f867d42bd20af9718e18407594cb24a08e939a54c2b85c3055277d1e8c922921c1ced244e25a9a92b2efdcc9e29e3e2149436b7d7222
- SSDEEP 98304:ekEFt3dv+GOxstemEbxQiXvr95n5mYrXLkD9N6xif53uveOI1huicXM7OqPcTced:eNFt3J+GI/mEbHVXLkPffIv7I1ojXIOH
- TLSH
  T11D5633C638DB3B74D15BC3B0A193349D7D2D7FC2B9338D0A3B997A005EB29261676291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2