42595ec3118704b26f83b3895a9d7d0dc1f73e8aaefc795554f75e3f3604faf9

General

Target
42595ec3118704b26f83b3895a9d7d0dc1f73e8aaefc795554f75e3f3604faf9
Size 4.9MB
Sample260729-nbgbwasemb
SHA256 42595ec3118704b26f83b3895a9d7d0dc1f73e8aaefc795554f75e3f3604faf9
MD5 e2fcfd120c516a65ddfd2cbb7f6a6351
SHA1 f40fa63915ddff72d23f5b3202f7442ba7736474
SHA512 a31f3a330fa7f8a302eea06a64a093e9f7b448a91b681d8ee51927d22b9396c21b1ce8d3f4cc4b5e263ab1f3af7385e01393a9b9810dbc5caa58dcac09c8b3ca
SSDEEP 98304:o4cBVtS2apemj0gkyc1P3q86EgEvz4+NsdP7Z+afpHxiRQxYAcq:YVrkemwgkyWP3D62s9Zz8QxYAb
TLSH
T1223633FA7182EA570C45C9903A9D8BD43626FB6ACE07760DF5FE390A038D35E8161E71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Install_28n014.msi
- Size 5.1MB
- SHA256 b798abf09e19f2a9f7d01258744cc1b0522858a7d8b352b29d560e7413e7454f
- MD5 fbc80b24c76a2f6ddd7e1dbdeceab98a
- SHA1 327852eb3764be9a1301663f4bea150bb81dd0cf
- SHA512 e04343c75762b49ec7490091f56b40615fb1bc469e23e4a6ec028fa1556bada5031b1aed7000f6c4ef20b16afb15e9d934d0b13c15a4e6f98e252caf83608e25
- SSDEEP 98304:mfRhs68reKjIg8u07Px60GamYjZLpBbcrrFseJgA/btg1i0o9:2RlKeKsg8usPxvGSbyFseJdg1i0A
- TLSH
  T1DF3633EA7DC13775C08BC7B0118629AE3C297F15FB2B5D0A7ACD3A001EB27195A317A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2