5558015db127cae9895324c71c905c1955f81a793b2b8036a03deb1d9da44d11

General

Target
5558015db127cae9895324c71c905c1955f81a793b2b8036a03deb1d9da44d11
Size 14.8MB
Sample260815-hxw2ka1eph
SHA256 5558015db127cae9895324c71c905c1955f81a793b2b8036a03deb1d9da44d11
MD5 1ac193f09647fe1283f485adc141b5bf
SHA1 c7715c252bdb5bdaf9e10eb1ed4f93f831f773cd
SHA512 01d0febf37eaf7228ec6bacd4cbf5e06ef05173c844f159a6f88f5b35d76ac152aae3bd445cad720606399a7f4dda9cd9058fcb4da58c7ce60840a751edb175d
SSDEEP 393216:95+4X7kEtO0NsGKtc2Gc4arZhDslAn3sa38RhMn30jiN:ue1ZMrjVN38Mnw4
TLSH
T1E2F633B667145A06E1B7BEF6F1B0180534CD22FCD5DAF82AE36533D47FE21A88218D52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  appinst_up008.exe
- Size 36.8MB
- SHA256 017c734ece200241bed47a9dbd2b40a8525813aa9297ff907a5ae2f6c7b9b241
- MD5 db7f6a29720a66a45865dbbda3359ad1
- SHA1 a50668689ccb5bf575a44689cb56c5474cd4d8ca
- SHA512 246946715060e758d6dadb4f8dd049b1a69103c56b6a5df931d3500e24ec21b8837220805da46c6fcd4560a1470d47c868e543f533b007e1d21205ac73162a05
- SSDEEP 196608:sFnmfRW0ATZPh7c2Qp3BqtiEPFNPyDhC81eHIe:0SRgXQhDhf1uj
- TLSH
  T1CE87F84ABB41CDD9E136923894AB5F01E331E97186B1976333B02729CFDB38C8F66558
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  appinst_up008.msi
- Size 8.1MB
- SHA256 c8d9f700e3c58ab26fb01fd6a865a86bd4df3285fc479372c3f21cffd96a1205
- MD5 7c3ae4010e67cf2086ffe5e82379514d
- SHA1 7ffcfa8b9396142993a4b4567e4414f889609e02
- SHA512 1eed9f73f1a052d21237fcc412a9504608d85f838b9c1ed10060a4fbee0544039251a46242f2ae71e9b253285668e7a8a76899167a7da87a68a9281c0c2e82cb
- SSDEEP 196608:JtGOBc0yTIzDEta+ltfg3qmucWLiaMlLNs6t+3zuLv6oVbp:fGOBSTIzDeaKHmkjSJD+3qD
- TLSH
  T15C8633CABD8E2B71D06BC3F19142746E7C6DBFC5BA638C577AA17A101EB21205337648
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware discovery exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral3 behavioral4