7b131cc63ecde2a57d873b617c7893e8c4a36a24b51dd54ea05ad05871b0ef05

General

Target
7b131cc63ecde2a57d873b617c7893e8c4a36a24b51dd54ea05ad05871b0ef05
Size 6.8MB
Sample260803-j9mt4aee84
SHA256 7b131cc63ecde2a57d873b617c7893e8c4a36a24b51dd54ea05ad05871b0ef05
MD5 c337c6c508aab3816ed9e481d83cdea2
SHA1 9d1dad89928789c4bd47c54e785b563912ebcd7d
SHA512 8fdc73d866afa3409816dfe7074e5b8566a2713794eaaded3d9e585f4d4543dd67c60717f0a4828336f6563540600195b448d729ad7708d3ab5fbfbbe8ad364a
SSDEEP 196608:txJuoMWtyvu0Qm4Z5WhDZGGWUMfyJJQHMxntAfWsiXH+S:tqzvu08ZuDZ/5MfyJEMDds+
TLSH
T1436633EFCCF5A6869E8DF922530F439D66249CA7503E6CFD6F00A112B7C2811BD39895
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue018.msi
- Size 6.9MB
- SHA256 285cbbc3e0845a47bdab345b54e6c3506c4f074f7002ba8ed48b117eb868de4e
- MD5 560c0ec6c63fe8b0e1b7d2768c527022
- SHA1 8d981989ea3f9707f1569e13a54ab6ddbc17444e
- SHA512 8caebced3bb18a8c917729e0d479caf2a22493e9016e0d983784818ffc5a67f178df47e84fdf757c635b4c3fdd538d8f7662f09240f202ef765c93a991eda7cf
- SSDEEP 196608:29SQZyxOY+4WXJTJlK9bU7beJnjC1MGErDsF:pxOYcX5Jlkg3e9VGL
- TLSH
  T1737633DABCC62775D18BD731420759AD3C3D7F96BA3A5C2F7B8836001E7251ABA31680
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2