1ae2374d7fc82599bb21c61be12da3754205c55c909a4b5b6ee39dce35032582

General

Target
1ae2374d7fc82599bb21c61be12da3754205c55c909a4b5b6ee39dce35032582
Size 5.8MB
Sample260803-t229xscc32
SHA256 1ae2374d7fc82599bb21c61be12da3754205c55c909a4b5b6ee39dce35032582
MD5 e4e9a8e1811a1daea407aba6bb2e991c
SHA1 d5eb865568c0f83ab00e9156e8d52411643db9bb
SHA512 5e36dcdfa0fae9ba85bd8053d92f6360c4a703ac4ce536ee63e2844e49dac0e3c5c402a719cd9c66f4d7fc831a0e03c1eeb1b9b97be11214605fcb05f5141192
SSDEEP 98304:5VwDJyPuGvVMUku4/Uxa4k4pwxt/rTe+/xyywRLpgwCW4eRNpNfUw:5Vwc3dMUku4/6tk4At/rp/xy1Nr/pNfR
TLSH
T1DC5633E68845A8DA5823C5E1F05DA7053A1E81D69CAC7EC3BEDCB3845893BDF0579233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j017.msi
- Size 6.0MB
- SHA256 fa8ca78f13f47767a1e1b721fc4590d865026c574671a83dac3025628faf28ee
- MD5 129cc600207d446ed1957be122b512a1
- SHA1 4507b46b6e1414a5c06691e5bf6fd2ec81756907
- SHA512 c55112c1bb61a0dd4c89c8fc6223b91ae1bfb69edd3af0ba5813649ce647014e1b6635e8a1e8e613a10880fcabb50756328b6937fc9ad75c699253c8b09d7a4c
- SSDEEP 98304:h4vn+vuSDjkEe24nOjJOHxHh0kClfLv+TFlsVHkVu/vdwxLViwCaW4j/p/fAV:yglHkEe24nmJOZh1Cp+lM/v6pvjp/fAV
- TLSH
  T1855633E6BCC563B1C097C7B09096355E7D2E7F81B9AA5C0B76CD76402E733164A3A30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2