e1abef3a4b2dde8b58e2b12e54adde81a732d8e1237b9fadd0e120451747e5ba

General

Target
e1abef3a4b2dde8b58e2b12e54adde81a732d8e1237b9fadd0e120451747e5ba
Size 9.8MB
Sample260803-jmc2daej91
SHA256 e1abef3a4b2dde8b58e2b12e54adde81a732d8e1237b9fadd0e120451747e5ba
MD5 6864fca3132e8c89335fce2839ace6e4
SHA1 1674206f23d42a6800f1426b36733ab412deefaa
SHA512 4a7f209980eac55226e7493764a9bc936fed6c4284a4d48896f0adf95fcb3caf8947e599e18753ed904b2f5fda0c4d880ba0b7c8c5061215fcc2976676d78586
SSDEEP 196608:JfwjScZn7i237AOAl5yJ0bAw+dbcoDZremM7Qx+PveGH59iihB2a0QuY0UkFm:JuZneMA008vbcoDZKVQWmGH59i62a08b
TLSH
T122A6333AB8B4B819FFC2C877A1D18C0B0B579CD8C6304F3CE999CB599A6696345F8D05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_m3ue019.msi
- Size 9.9MB
- SHA256 8f14901e156cbaa3af9a20bba825544d553fd1ad8f1ab532e2dcb8756c988cde
- MD5 a047ae993e9e724ed8a47bc86fc3a70f
- SHA1 dd31cf30fbac6f52ac144c59c130cc049b34ab05
- SHA512 3b3370c83117c91309d3287cfdcc881959accf98eadcc9a6925bced3ba002adf7c20b061c2f889d8f7fa66d35b369bae5827e9694b8b938e881abe94c0bde6bb
- SSDEEP 196608:LG4rf1okp7YdqX+wk1VkwUvmO2Z/sA5tjeiYjQlOFL0YD5PsgtH+U8e4oI6gW+zH:LBrfyEX+wkBUON/sA5tyLQ0YYD5PsM+L
- TLSH
  T1A3B633A53CC97670E68BCB720042286E3E2E7FC4B7624D15FE9D7B141D7362286B6709
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2