a2f50a7ec199b7d1cc94061f7e33399de2a58470f68f196af6673b7cf28b3db8

General

Target
a2f50a7ec199b7d1cc94061f7e33399de2a58470f68f196af6673b7cf28b3db8
Size 6.8MB
Sample260814-re7vsavgra
SHA256 a2f50a7ec199b7d1cc94061f7e33399de2a58470f68f196af6673b7cf28b3db8
MD5 1b3d5e266b4e6842852ce38a554ca6f7
SHA1 67c9b9d9529301edd39bde2037fa3490f6fc27d4
SHA512 cd3db95fa59337ce5a96602a9e6bdbeaa39dc2a5a822f71829bb68976349335c6fc7c72495677936d2d52ab54fe57ec96d6d96d3cc8c0b6e71e99493b257b40c
SSDEEP 196608:0hMRGDdgTIDWS987a2w1Bz6LYAGMPo6CJ8NIQURu+hC3:odgTICNKBz2YcQ6CJ4iIv
TLSH
T19376237167085917E1B73DB2E4F01849345C26FDCADAB92FE3F837D4BEA21A98510623
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up015.exe
- Size 36.8MB
- SHA256 022fd650bf84b260d99c09d34d0add54b05a2fe06fc05f29779c4f018294e7ad
- MD5 b2c561687457623f83dca4d8aa72d953
- SHA1 4738f1c3543522ac8acb9895865c31d3925762cc
- SHA512 57fbe27b741fbfbc12705db9933cf495aea619e6a483a523072cc0960e2bf0b228913bb1e51edd34e383d2218f85dbdc4ea969ea6a0ed7e9b7fb60bd08d9024f
- SSDEEP 196608:ZFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHIE:/SRgXQhDhf1u5
- TLSH
  T18787F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2