57800d723e976dfa94479b93bc088e90a91fc0ed540ee57fb6a494c70a1c2634

General

Target
57800d723e976dfa94479b93bc088e90a91fc0ed540ee57fb6a494c70a1c2634
Size 6.8MB
Sample260815-ae896svye1
SHA256 57800d723e976dfa94479b93bc088e90a91fc0ed540ee57fb6a494c70a1c2634
MD5 a75537b4ea510d2f521586a655726342
SHA1 f0cf0b3857eeeaae80c61ebfca41ceac797081af
SHA512 381f26d65590daf8f7432151a247f30a32d23f17ffa700c07388bba038cb1a7ec9978a8b2c2e7d4238ec6a0b810bfe32b038478bbce1706f1ab3d2831d7d2774
SSDEEP 196608:a/jWCUokP6MLQHb5gbiXktSDsd9u5rB9BC+ykhjEfs8Dnac5:+qCU7HqbuiP5vBBPhjGsunac5
TLSH
T1CE7633B873285516C0AB7A32F9B04847345D36BDD2D9E819F3BEB6807FA157AC610633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up001.exe
- Size 36.8MB
- SHA256 4d39376c5b2e0772ee9057ab869eee0887d8c29dc813fca33da0cdbf1e9a34ae
- MD5 5c0c311caff99b88fd3528f20f75ca85
- SHA1 d36a5a5b78bb065378b9d3815f7f29c3a0e69e02
- SHA512 807d75b8e014821dfe1883f64b86f8dd4a94665fb4d7f73f4d6fd4ef501fdc9851252824ea935b292da0a58deb4cada65ebc883101efef8281c97a97a01f9c41
- SSDEEP 196608:AFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHIB:4SRgXQhDhf1u8
- TLSH
  T1D887F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2