074e70c667c7850a904b6127989bbc2c46de8b24c79b61a7fd6f21a29e99e3b0

General

Target
install.2.0.02.zip
Size 3.8MB
Sample261018-w2yylstset
SHA256 074e70c667c7850a904b6127989bbc2c46de8b24c79b61a7fd6f21a29e99e3b0
MD5 f8c0d360127342a5fb8b79ce0ddb9308
SHA1 b9947dc36de411096ee2297aa843a47cb7c8bdbe
SHA512 cceb2cdfa998f46ff25ec19412bc4f76cb91a6544b67cc8fabae386908797c09a1212ca08a7587e8da739efc2d180b82d125707d1cef8c92c36f4958a78205cf
SSDEEP 98304:GjyFexQv1ukyMweIW9fCRooC1B+9kFG8b/:Gj/xQunAHoWfA8b/
TLSH
T1B10633CD70993A02EBBE96FDD988AAFCC639B7B3B07840C6516853BDC70DD9050C6591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.2.0.02.exe
- Size 30.0MB
- SHA256 ff6ec075348b964d5910f80aa088508d906900b5a316a967eb5e5e4043e655f8
- MD5 8d4a4182b818f5a2c944469670c638e8
- SHA1 82070f85472007f2c0503c7fa6501e34fdb68298
- SHA512 2e3a2186bc529de1bcb159f94790997ce5b09da0416c39e7a9e1b43d6a1ef5a6d2b5ff4281171a7e220ef90d6e108f81941752c73ed2403417ca4e0e77ad408f
- SSDEEP 49152:r85t1a8IFXTDqgBEA9xzJkW40bkSnY53wfC8oWz2rf8oW7O6CcxuLxxuLexuLUB6:wlaNCgBxzWWFA3w7Nz2rf8ogCVbojaEP
- TLSH
  T11967D68ABB01DDC3F44A9270D45A97E16372ED71CFA1871721A57F157FBE2888ED2088
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2