c9c2dd441be15cb5157a260ac72405bea1d8cc1e72fff107fede2113a1497abd

General

Target
c9c2dd441be15cb5157a260ac72405bea1d8cc1e72fff107fede2113a1497abd
Size 7.5MB
Sample260802-cpwsyascld
SHA256 c9c2dd441be15cb5157a260ac72405bea1d8cc1e72fff107fede2113a1497abd
MD5 6cb531a905594cef12c7d55b6e7e618c
SHA1 e802fdb41a553daf272c813dc61ea7e57cec3cc9
SHA512 b514aaaa2ef3ca1af343c252f3bcedfbc5355c138847e8685322303b33082c9448a7507783537cf0261089fceaa0da8d8c1396f5110ded4e2a5d484d3fcf0207
SSDEEP 196608:AkxbN5NCunUB20m9G9bGX5is6ONoYMspJU4MUk8GON6PzYWG9HlB2iXTOU:A+eAAUDCYlMKqPzvO2OJ
TLSH
T174863383AF6F2181DC3C3D827E2CAD358E9F75D24B2529262846BBDD9D054D3512B0BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up005.msi
- Size 7.7MB
- SHA256 9b0c026aa6e3a0e174637a0c773c99c7d47518941756a7937581d798c76370c1
- MD5 bb1de9086995cad7e9a9e97fb58b8d73
- SHA1 f1f28c9b98925735921915be70d6309d21ccbf77
- SHA512 bb886f9c332ef901ba8ef51d63aeb8658b4f3bdde8dff41ea24b544b7d3a50caad3979c8cb9b91750e13b9cc77f31b71caaab0a676f5cafbbed0a2c59f5991ba
- SSDEEP 196608:IM51bJ7sclEp2sOtMKpkKchey+lr4ywwoKIMzkPV0EG/xPnSin/gi:IA8oKhVeLwUSPVjqSwH
- TLSH
  T10E8633827E8B2770C05BCBF16A56A17E715E3FC26F3A1C1639D97B4C6D3121600B72A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2