c05dcea83e1885d1a8a36f1026f42a0a52ad18825c2d7303f397b2abff264dad

General

Target
05112026_1433_05112026_install.m.1.02.msi.zip
Size 6.9MB
Sample261105-rxcscsa15w
SHA256 c05dcea83e1885d1a8a36f1026f42a0a52ad18825c2d7303f397b2abff264dad
MD5 2c9f6269d0e4233177946fffee484d25
SHA1 f77c16b24bf13edf598056bf114d40e18e5f0a73
SHA512 c4ab11894d2dbe72cb4e9434d0f40faba60e511a4eec85a37bf0cc97889222dcb581d82e25b70064a2ff53c9c437e6c2834bfa25b3e006d3c644811cb32fb460
SSDEEP 196608:I4XneKiwDGy0rJZK8/GUfBT+eked18hJy:z3Zi9rHGS4hed13
TLSH
T16A76332349EFA63CA341E74E7E3F187762265CF50F65144EAF22D5089AE08E1EE5490F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install.m.1.02.msi
- Size 7.0MB
- SHA256 d8b964a5352040d06b0af879d85e504257d96fb4d797f8336591f509aee00f89
- MD5 66bdccf626910385050da14f85cc0e0f
- SHA1 8a1317957dfa897d39be3875a26e2c3e183a3cec
- SHA512 48fe0f7e9d7bd4b7984d04a2dd6561b1ce4c3c633307c980cc17bb4880f251176ba8cc136c9455ac1286fc9149b9fd0e1098c8975d473cac72e402a90d3cf408
- SSDEEP 196608:DOGG/MG4TyhaqC/1buQLru5YYC+LN0nRM:aGG5O/BRX+LN/
- TLSH
  T13C7633A23CCE2735C08BC3752913267E79297FD5BFB35C0A6B6177040EB1725A63960A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2