1f3f8a425a9016d3f801beea14643e370b6ee524bda2a59c322b4b0b77b36d80

General

Target
1f3f8a425a9016d3f801beea14643e370b6ee524bda2a59c322b4b0b77b36d80
Size 8.2MB
Sample261105-knmsmsywds
SHA256 1f3f8a425a9016d3f801beea14643e370b6ee524bda2a59c322b4b0b77b36d80
MD5 e3d954514c7d6815820946a9db56a9a5
SHA1 3400b3113624365405840f3ef94fb7970214baa7
SHA512 dde01bb6aa6ee1b26ab345161d06b4dabfd455daed0100855cc14c3cbb32aed6a026a8f5ecb0e3e7abcc018af1cfc5895ab85737c808be61dc21965b5a4d701a
SSDEEP 196608:SpQbDljE0KISk1pWvnGFwNk3AkN+2DXXP5J9QiaTOedUwPfX:RjE0KISg4vFNsyEHrZaPdJ3
TLSH
T104863319ADE77FB26325266F0D4C94ED2E86C98F0D35DEF5AE042901DE17AE0E303529
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.m.1.10.msi
- Size 8.3MB
- SHA256 dcf4f3e5b2ef3bda906505596e8bce575914087458da5a507dd458fca56acdf7
- MD5 80c5031c44a5030dea04d5f48cb4144b
- SHA1 b0464bcb5befeb9c18534f8f8bb6499a226fd1f1
- SHA512 1121cf92533e5014d300341d334eb24496f6c8656e35b9b0d792458ba3ec1eb3480669e0445fa502a907e6f200f2dbbe882ef3940cc53e93bc3aec72d09da5b2
- SSDEEP 196608:KsCaYtIgQgw2J+SQBJCFgbkF+GB+srrX9VbDqKefi+xfuHd1:KCYtIgQgwm+dnb2mmLLNeXxWL
- TLSH
  T1479633897CC63BB1D1A7C3B94446E4AD7E5DBF8A7A358D673A0939009D32B209333359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2