f9e5413b212f6f35c9393ccd05245e27cd1d80dad947f67b1472bb802b04f0de

General

Target
f9e5413b212f6f35c9393ccd05245e27cd1d80dad947f67b1472bb802b04f0de
Size 5.4MB
Sample260803-hypnwadp2t
SHA256 f9e5413b212f6f35c9393ccd05245e27cd1d80dad947f67b1472bb802b04f0de
MD5 2b8975199cd350870fd6c7a4745f0f73
SHA1 971acb76b0bd7d47862526496103ca50eda565da
SHA512 3b4a8b645352763833f045068145845a56a1de3e499919d757a628295335c662ec5ebd1f5abd0a5a5267c996174c999883d00cd002e53b50dd0ca509dde1f7c5
SSDEEP 98304:fpop5MTJC+crgTBnZ8fj0Pse7hl3IYwRjszleghbLoU3NhnTqywKSOH:fpSCVC+ssnWIEePutwtFLRdhXN
TLSH
T11046334579B219E6F5D233B646678A0D88F24333B747B088AFA5CBF5FAE2C504160BC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue016.msi
- Size 5.6MB
- SHA256 16d82e8398bb3c8911178cf6f1244886891d589c42807a0c1d0f45dcb4bb727a
- MD5 70f66240860cde90459429c8632b5ee9
- SHA1 91eb75ab7428120e6ade5f3d43f611d6b0b9e041
- SHA512 7a38547d41e18378cb6c80881c9ff924c164a533404c8803d9a84b1267e5961341006eda2daabbf048fedd6cc535659cf5759317d0a9edd5a9ad9a354340ea9c
- SSDEEP 98304:Yxzu1Jo+CrgN5XN60RMMphX4yhj7Oyr42F/B1hgLbLu8RxhNtcGU40:Iyro+S6Xk0OMpl4YOct3iHLbzhL0
- TLSH
  T18046339578CA3771D04BC3B14623622C307A3FD6BF6A5C0A79E5BB5C6EF2A1904B0785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2