dcc70db02be6b7faa20d3d404635a9c8bd01b4da20c20350bc1ab5eac52c5a1e

General

Target
dcc70db02be6b7faa20d3d404635a9c8bd01b4da20c20350bc1ab5eac52c5a1e
Size 6.2MB
Sample260802-rbzd8sthre
SHA256 dcc70db02be6b7faa20d3d404635a9c8bd01b4da20c20350bc1ab5eac52c5a1e
MD5 0e80e7ef4c68c4d3bda789b782fa9094
SHA1 e38f154066e8a72e637f64efc7c6dc768025b58a
SHA512 1ecd8bc8dd63cfaac138dcbb43ddb5b59dd41bb93667a5c06e0ae66c93307c7faee1a883985c98cbf1b5db2c6dfcaa9bb7c3ec04d6bd5725258e2f91f0d43067
SSDEEP 196608:xNCs0LPX6u81vGPaI7nkY1lGh/q9g3Zky9s:CsCPX6u3lzgpkx
TLSH
T1B8663367BFDE206E63F304E6FB3B35E69D385048806464FBE0597AC19E18E6C51D6AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up002.msi
- Size 6.4MB
- SHA256 e0422269c1b5e63515a6556247197d0cfafe93ba12b0befced2e9b9926b20952
- MD5 d430ace2a6a427d6403f5da4cff76598
- SHA1 1d5ff3b617c685b4110aa03fe78d8a7defdc95a6
- SHA512 d9e349bd1128e05939dd5630fa3e9fb9c3fbcebdd98a749bd10a169d4773d4d34da74485c0900a84b8b7d88337980159f9c83ad5dbf35eb52dc31bc8d6c1ac39
- SSDEEP 196608:pvvjbv/+u8PzGJ6i7h20H00cohVnU9900LH:ZvHv/+uJHH0fmU/0w
- TLSH
  T1A7663392BDC93335C2A7C7B0951738BD7C3C7FC9BA329C56B5983A405E72B295276280
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2