32d33c4b8cb5aa6dba7da5e66e8bc2858d1e07938e23bcf5cc45670e95122f3a

General

Target
32d33c4b8cb5aa6dba7da5e66e8bc2858d1e07938e23bcf5cc45670e95122f3a
Size 5.7MB
Sample260804-a8dqcsej6s
SHA256 32d33c4b8cb5aa6dba7da5e66e8bc2858d1e07938e23bcf5cc45670e95122f3a
MD5 cf93aa99dfd24714e811825210253cb5
SHA1 85c17961e7ed486c052e9f1be6524d05acd1eefb
SHA512 b7ee0d33c6bf6f4d37fac89d01bd553773377410255a01dbbddb6a1af0b61a659f9c20eca1c38e3d7297b99caa8529d1b8f883e9a4373b4a75a96e7edf0abfe0
SSDEEP 98304:YQkl5BgFDQasXmiD3kF/wRs4Mr5BO1XyQtt9yG/eYBnOm6S2svUq8ZaQJDyzD4:YQ4I2IF/DQwQJJVlIS2scq83uzD4
TLSH
T1DA5633CE0688E5C14F61B6765A34AE4C720ECA94D3E93BA9423A34D42E0FF501D9F5BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j007.msi
- Size 5.8MB
- SHA256 a687bdf525257aaf92b1f4d734e6dff1446b6c2646ad2a3abb9ba17f619747d3
- MD5 92d729ed4bb6939a0942caaa51fdd878
- SHA1 6516d8ce794a49e3033a2d4d53f1cbe38f1c350d
- SHA512 9d00ce5ec951371538063ecdd5476c4d394ce972cf494784536c3acb693fc14440e166f9064a469675fa706e096023841423ddf09c0024b82d38919136b64e01
- SSDEEP 98304:6J9KtA6QN/1ps9nU7s4y/vT41r6J/uGlpOeKIsRUo2zyyXxy31E:49VN/A9nNMd6lZjiIsao2fw31E
- TLSH
  T16F563382B9CA73B0D45BD3709522B55C722DBFC0EEB51C1B76A9360C1E37B0518BA35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2