895748c13fa847ad14cc08ad9aac7a07a77d2e166826ff0bb112fcb0c1178b6f

General

Target
895748c13fa847ad14cc08ad9aac7a07a77d2e166826ff0bb112fcb0c1178b6f
Size 3.3MB
Sample260814-etsm7avsey
SHA256 895748c13fa847ad14cc08ad9aac7a07a77d2e166826ff0bb112fcb0c1178b6f
MD5 385b9f7f23627023682d3c2cfd2b51e3
SHA1 c8c1ffdec8901f9e05fef2265b5cac3c932c0023
SHA512 3965fdc21fbcdaf29168747185816b3d797ba1e0f61696556b918f135762a2b884861951b61e4c75e4fd914381ea75a6e822fe9e91681fceff507acee6e02b7d
SSDEEP 98304:Tf/rR3BoJ1QGclAW1bvV1MNU4p4cFuMaQwxAxuBaDkI8BWrpU89mi1:D/Log/AgbvV6NXJFsAxu8AI8BWFd1
TLSH
T145F5334BCA2FFF69E9E5617BEDB8182730844231CBCE1BB5C1578DE2DE61A816055B30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_sint001.exe
- Size 40.7MB
- SHA256 f11793afcc23562e8b5e6123a9b5dca318c251a2c47d1ec1fd1b15434366b72c
- MD5 4d17a0a5af80ca2210aa04c5180f1327
- SHA1 9ce8697dc1e4e287b4a7462a4a39227b1c9e0c02
- SHA512 35aaec88960fa00f784e0b3d3e3c243c31a78d313f0f1e4b74e1ee01891dc41bd91ddb04af7d165d39f000e0521124532ab455b2af21bd06360630f3d5483f6f
- SSDEEP 49152:7JXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntp:7u/9nmHZLxG80DuKA3XAD8ntZfh6fgCi
- TLSH
  T1D4974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2