c0f3823a4cf084bdd0e083f4853759e90da1c98bea8980da48c7ab97910f9ecf

General

Target
c0f3823a4cf084bdd0e083f4853759e90da1c98bea8980da48c7ab97910f9ecf
Size 6.1MB
Sample260724-hzvarafa25
SHA256 c0f3823a4cf084bdd0e083f4853759e90da1c98bea8980da48c7ab97910f9ecf
MD5 46643d49da145497b3a3d90aa2236d1c
SHA1 c814423e7ad1dfbdc294399c9d11171bacfcb036
SHA512 ccc4bb6b243aad1b37b61c03292379fdca4fabffa22eda0ab028139eeff8e45d792ff8b6d48065d3a6cac9be28c06844cc2f0dc93b348878f55b35cbc7744655
SSDEEP 196608:zpsgnXAfXNLizLM8kbHCm9ONlWz6RXvUbM9QA1uALKwXqOiE:9vuf8kbimZ6RMo9P2E
TLSH
T1BA56336ACD07261606F72A72499FF5BE09D248B34F059C9557F7AA8FA4BC8407D3F202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  intll.0.88004.msi
- Size 6.3MB
- SHA256 9780832e831479d41bf7a26fa00fc89af75d43477abea31d6724b8cbf9ca78f5
- MD5 c3f0d50e71ef71c7e4ac219097175aa9
- SHA1 2907cf05d8f089b767e120287ba55cc86a8b5e43
- SHA512 7eb6182f15a9dfe678de964d5644595dccf1d99f258c40f38b3d90568b3cbe72187decd791656977866eda545259cb65635c3d77dd8362b8295151ed10b929ad
- SSDEEP 196608:qOBv1qDgnnhvuJt0mkZH6m7Ox/iXGZDNsE9k4juiRqefqmeK:qav1qWZmkZamA99OK
- TLSH
  T172663395BC8A2771C1D3C7B04583647F7E1A7F12BE638C1676E97A491DB2A102A3F342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2