78a3b7969468c39781aa14a4f532d6af1ef22f5a3f229a8ba60a20446df0f838

General

Target
78a3b7969468c39781aa14a4f532d6af1ef22f5a3f229a8ba60a20446df0f838
Size 5.8MB
Sample260803-jc596s1ema
SHA256 78a3b7969468c39781aa14a4f532d6af1ef22f5a3f229a8ba60a20446df0f838
MD5 6e0649943f8e288a015257c26ebe6704
SHA1 80b447b4d7c5dab313823e708dc9b4395a464fc3
SHA512 e7d50081c517374c3fcf68304763286c4dc73df50a7ebf7bb65f6155408312c90e7847d5815847423b2815f34f631ee30edb76d5ee7db3be42ce10f88cb94937
SSDEEP 98304:TqA/BoYVHx8fyEu3x+GX7xNpn9GsrRxk9PNgGgdbMbFEP4Bjiio1a/oC7cHcU4fR:TH/hPEu3FtRxkfgdKxEP4BuV18oCAHkR
TLSH
T1915633C620AF6A45193F7296F65F4142C61A6B826413E7003E654F52ABCFCBB3CA5DF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue017.msi
- Size 5.9MB
- SHA256 4cb1e942a4926055ab71af1c2f686eb188d0e1bca84c08ea0a87f44dabdf8283
- MD5 ddb56e57a7df27e71538832fb983f633
- SHA1 0bf31fd67c4d3ef0debaf9e2ad46745bb661d61f
- SHA512 03c92e3d22c1e3ec8fad6f6ff1c6d6e148dcdbee211cee23f0febebe1caa0cb76de59d0d150657a27895f8226eb9199eb4b6da6a3b38ef7977b48d0c148065e8
- SSDEEP 98304:ekEFt3dv+GOxstemEbxQiXvr95n5mYrXLkD9N6xif53uveOI1huicXM7OqPcTcef:eNFt3J+GI/mEbHVXLkPffIv7I1ojXIOF
- TLSH
  T14B5633C638DB3B74D15BC3B0A193349D7D2D7FC2B9338D0A3B997A005EB29261676291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2