f1a8987f4da849302740d4e5393014eae6dce2c265e48feb3a73b4fda44313d9

General

Target
install.m.1.11.zip
Size 5.7MB
Sample261029-g15mfaxtfz
SHA256 f1a8987f4da849302740d4e5393014eae6dce2c265e48feb3a73b4fda44313d9
MD5 6acb64ade63353a92a5ebd894bd26bf2
SHA1 807f605b595f9400003f3e715d17bc0a26e18677
SHA512 260a3d2778be59b1c4b43078ca88c8a849d36ebdcd899a936f839e9b28ab234b238353460951e5688b58aface0d9021ddc45fb6e6a916e0a2c4e04e5722862ec
SSDEEP 98304:MX+VxBCMM3U2oFjCAQCA4BMoP4x3T4kAzGMzPt6v4ieGgGcI8qDaF5ZWq3wg:IqxBCCjCAJA4Ghj4k1M7t69cI8qDaf9/
TLSH
T1D556330A97CAA1B3704DC686AE78421B49531EF4236809C1BF22BFFDE572D970E6D570
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.m.1.11.msi
- Size 5.9MB
- SHA256 30189abe92d154f0bb28a6aeb2cb5fa7305b61a3c62f629910b1c2d7dc8b8ca0
- MD5 45c423ea093e053b201b6d00c745b29e
- SHA1 db579338bb581c7b12cc9fd128708882c28c128f
- SHA512 4c9db2a94a5148d32b0118efbdc531e88718b21ec1188814d28339bba6ab5dfa9b002f3ac120be2e5f1fbae8998d05f08635eb82da401821af0ed58061e139bd
- SSDEEP 98304:eDimI+59D+3alOGoFjkmuwmmTM2PI5VnNLMbIUK742I8GCGKgSBan1ZQsl8f:eDiGD+3VjkmbmmgLNJEXKjGKgSBa1ll0
- TLSH
  T15C563385BCC622B1D05BC3B5A241216D711A7FE47F724C12BBE97F8C9D33A1A097A394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2