beda41a26bd873cee400e9090337b7da720f619c15aff0d8cdafdb134645825f

General

Target
f02bc1401bb7b817145796be2340fbdf8a091c293eefc79f1aa95c8d66678d01.zip
Size 10.6MB
Sample261110-kls7mseb52
SHA256 beda41a26bd873cee400e9090337b7da720f619c15aff0d8cdafdb134645825f
MD5 604bb24f9458a4fb83164bbc4414cd8a
SHA1 8cb7f78ec7912fdfee02cc9a008901a2c0098f97
SHA512 2c7c726e03aa73d658679024e66ba2f762a4c3ca67b400d5da4656a24cd6ea03905bf29c89f6a26e60c7d0978d8fa9ce10f2a91fc96ccffa8fe6549ea777d61b
SSDEEP 196608:ovLr0+tbaoQNGbwsUaWOq2ez6GBU0wuVCK0H7oK2RVplJjEzVOsT0wwGlS9d4zrf:o7QNGbwN/s9GDwuQRoLRLlGzd0wwGlP9
TLSH
T176B633B5CFD4FCACCC2690B065A72F9BC78B75A9E1EE814596C312786250EBC7CD4290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  f02bc1401bb7b817145796be2340fbdf8a091c293eefc79f1aa95c8d66678d01.exe
- Size 10.8MB
- SHA256 f02bc1401bb7b817145796be2340fbdf8a091c293eefc79f1aa95c8d66678d01
- MD5 a370a316be68a553056de357085591ed
- SHA1 b653a0b08c8ee8d510106092169f56196f6ccf7a
- SHA512 21c177d6e5787821bd5366e27cdf75c55b66979c2d369631b7a7db24ee446597091aa59b746af391121cfddf0f1f87a965b865c3b71cdbfcf5f055b583c3582f
- SSDEEP 196608:I9cHlpSVyLwvj5txEEOJwVqiqpCJVHdziYPSS3uaHItOqrP+HsonrhbRjMFi:B/AyUv+ZaN996gultOqz+Hson1bpii
- TLSH
  T155B6332A5AB714E2DCB6D178A932C506D271BB1357329BCF0790136A7E179E30A3F724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware upx
- Modifies WinLogon for persistence
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Disables service(s)
  defense_evasion execution
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1