016c177bee10760f8a703da72c4e6ac60dc8fa37272a0455ddf687ea178ba634

General

Target
016c177bee10760f8a703da72c4e6ac60dc8fa37272a0455ddf687ea178ba634
Size 7.5MB
Sample260802-cgb4kasbmf
SHA256 016c177bee10760f8a703da72c4e6ac60dc8fa37272a0455ddf687ea178ba634
MD5 0705492f2949dc49f2398b43dd8d51e9
SHA1 b28427eda61e0c32520e6452213300eda36b78e4
SHA512 6e7b656ab91a3ec9bbedeebc6695944f72e3a47e6c26b47ed214502a4fa7d3cad17bac6b93e54213e2e288a361d2eebe45e5515daf3edea45eb090e824539ac3
SSDEEP 196608:9kxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOK:9+eAAUDCYlMKqPzvO2Ov
TLSH
T1E9863383AF6F2181DC383D827E3CAD398E9F75D24B2529252846BBDD9D044D7512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 21b7206f4597d0165103b06eb25e070d5bbf777aa08f8ffb56611516abee9840
- MD5 23a7962ab00fa36cadcb9c92dbe58f1c
- SHA1 f8ae408953a3034d7254c1aac51e0f6a0a9e3188
- SHA512 9de80b6ce856093ed429704851407b8535fd74affc11e00c7072271cc2e9b8d8a804d3b1655e33ae6fda6cfea956f12e3df39e65dbd9281e47524bbb23c1d71f
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gJ:IA8oKhVeLwUSPVjqSw0
- TLSH
  T1F68633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2