2121c4916a55c0d849e81be5309ea2e61efd42de2d117f305e3a454a066d20e7

General

Target
Huorongt_12.8.1_x64.zip
Size 191.1MB
Sample260821-djsprsfm7z
SHA256 2121c4916a55c0d849e81be5309ea2e61efd42de2d117f305e3a454a066d20e7
MD5 4950a0ccd05dc904c57318bcf484f935
SHA1 110721b2e11769799718527ef3d1f3267dead67d
SHA512 c21508a535023cb2c69a9772d9f1b3fb9e0547855988cb448c00c2dc5005f8c1d9ebf24792322f44e1272b1ceecfc79e62677a5b1d537dfd16fd0883f230be51
SSDEEP 3145728:G5RhuxwmEXSYuIhYCibrwPZLDxichJBFsKHmZ/ZZJViMcDuM/xh/tUuprEv5+U+8:+kxwLBpWCivw7ichJU06/XJfcSMDDrED
TLSH
T1A9A8337576ACD5950CF2B4FD27BB2D4793014AC4B30C5A32ED524838EBCE92B52E2B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Huorongt_12.8.1_x64.exe
- Size 191.7MB
- SHA256 ffb360df1fbcad86fbaefec16762b5eeb87ffc5d3938a0a45d4bcd3d425d303a
- MD5 bdbbd3ce93b6c4d666f051f281a3f6bf
- SHA1 4da2d3541a37f77a3d0f36095b7ed19139e0d602
- SHA512 4541dc4fc0c33eac6eb5104d1bb8a85a4e6791f8a20a18508d652fd3fbd7ecc10488e5418014774db5b8d2cd07cdb3adf2a24e1edb247638e4797a680e028252
- SSDEEP 3145728:wnjV93AWOZxMKSaoKDg385xiJHhrzxsskdzZSxunPjZt1YzdEBDnZoNKJC4rEEn7:2jV93AtZenwDQ85Eh5l4PVIgDZ0o5Yq5
- TLSH
  T140A83343725519A9FEEB90303360A11C3DB545CAC9614AFFE279B5A54B23232E9FF243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2