a7669975a72936b72320b066bf863652bb285398754fb9f0dbe0e6dcd98d230e

General

Target
a7669975a72936b72320b066bf863652bb285398754fb9f0dbe0e6dcd98d230e
Size 5.7MB
Sample260804-a63ayaad36
SHA256 a7669975a72936b72320b066bf863652bb285398754fb9f0dbe0e6dcd98d230e
MD5 7f9fc598f5453b551f2eef8bc938ef6f
SHA1 da8892668886ab388d5f08a7b953c3bf0b416281
SHA512 b6426aff78def0c0704ad3daf968cd8a565c53d707404462482122b6934d392b1be3c46106c98363748488c92c43f7f332b131679beee982fa697fb129e919c1
SSDEEP 98304:CQkl5BgFDQasXmiD3kF/wRs4Mr5BO1XyQtt9yG/eYBnOm6S2svUq8ZaQJDyzDB:CQ4I2IF/DQwQJJVlIS2scq83uzDB
TLSH
T12E5633CE0688E5C14F61B6765A34AE4C720ECA94D3E93BA9423A34D42E0FF511D9F5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j007.msi
- Size 5.8MB
- SHA256 a9ca0e6b0ba48abe46b69001fc1db055daf3eed3ae0a525210ba0f086033d8ef
- MD5 57e337b2df0379d7f3ff9a9a8a2b1e40
- SHA1 8c40b62efa88d711517955d56a31d6ea1f921c7c
- SHA512 d7497cdc518e61e2d5a22da46f5d5813757396d3898031efee0e0e01308de7eb06e0a4f994e2b447961d13cdbba2b91655e260e8671f9299c8517b247f499108
- SSDEEP 98304:6J9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOeKIsRUo2zyyXxy31Y:49VN/A9nNMd6lZjiIsao2fw31Y
- TLSH
  T103563382B9CA73B0D45BD3709522B55C722DBFC0EEB51C1B76A9360C1E37B0518BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2