ccea14d8d792ad4c25a2f449d46c5f3ea1db225d797936b7364159528b64e3b2

General

Target
ccea14d8d792ad4c25a2f449d46c5f3ea1db225d797936b7364159528b64e3b2
Size 6.8MB
Sample260815-cml6qadd29
SHA256 ccea14d8d792ad4c25a2f449d46c5f3ea1db225d797936b7364159528b64e3b2
MD5 fa0b32985025e4e6ac38eef0d093d7ba
SHA1 20fa5430f657dbbad7c9bae9ee7a488641dfdece
SHA512 a2feffaf8f24f5fa19461f19430dc056d4345f8c9578bc09ad95cff7c092c895f3434d8021add7dd60389472169eeb884e12f495c76ae5a2e3e332b9177b22b8
SSDEEP 196608:G/jWCUokP6MLQHb5gbiXktSDsd9u5rB9BC+ykhjEfs8Dnacl:KqCU7HqbuiP5vBBPhjGsunacl
TLSH
T1427633B873285516C0AB7A32F9B04847345D36BDD2D9E819F3BEB6807FA157AC610633
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up001.exe
- Size 36.8MB
- SHA256 690a0ca12f3c15f3bc46886e756f3e3436bf4b9ed4767bb0c84dc8f53ba33f81
- MD5 035f974122155d0a60f767a8c3765688
- SHA1 14b8a6c9e424350c64c208ca6c45c4f17e4f9827
- SHA512 4c2931e6637cf0a1715c1e998df859fa5794f7329e17a75f107ae14402478a6aec2d9ceac78ff28358a19551a01b33047911cfd216d998a913e38ebade89c395
- SSDEEP 196608:AFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHIb:4SRgXQhDhf1um
- TLSH
  T1ED87F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2