0c1bff5a75dfdc2279d44c0db567f8dd4c5fd8881938934bcdc2283c35f49a0c

General

Target
0c1bff5a75dfdc2279d44c0db567f8dd4c5fd8881938934bcdc2283c35f49a0c
Size 7.4MB
Sample260802-tpxtnssvcx
SHA256 0c1bff5a75dfdc2279d44c0db567f8dd4c5fd8881938934bcdc2283c35f49a0c
MD5 537eba975f2fd1fd190db2929a200cc5
SHA1 941da261942261fcfcaa347b8e6bba5ff0011da0
SHA512 9c82fb45f3fbdb9bc02b584cd1a73cf830450cea2e8f42b45ad267e58eaf7b6343c1cd555de6c217eb98f11ec5d5ae88f8a7b88fee695d245a229d4b79378386
SSDEEP 196608:HUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAlq:i//aNFSOaGU4BPHn1Bfq
TLSH
T1357633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_s0up006.msi
- Size 7.6MB
- SHA256 66e8197348bfafe659d33f5851a4a47280b76dcc648f3e581ed986542a5d1033
- MD5 254fe28716916583e3826d6a38d28b4a
- SHA1 e6fe315e25dbf21a863944daaa10a5ecd098bb54
- SHA512 ab51f7e61c5ede94e01b2b3b3549127bd91d3c317f264d2d68d96f3dc537b0def574e4ba6da253f03dc2ae6f36c774dfd2c1160665af4bcc805f37ff74d1f6e2
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/euly:0hjaxXQcWaSnZNZHy
- TLSH
  T1718633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2