b7f672fcbe338646f4040713ba1d16dd7ca331c5d08178dbe37a2d62bbfddfa6

General

Target
b7f672fcbe338646f4040713ba1d16dd7ca331c5d08178dbe37a2d62bbfddfa6
Size 6.9MB
Sample260804-2rfl6saa54
SHA256 b7f672fcbe338646f4040713ba1d16dd7ca331c5d08178dbe37a2d62bbfddfa6
MD5 ff086c3e2d3f7903fdefd2f0e08684ad
SHA1 f1e05f62e67e1e74746dbe9fdf9f219670429a29
SHA512 d859d596f62e6c54cef7e597236904cb207d92250c54d01338cd1761fd93462954b0de82a06fafcd9162b3ca89aa08dd3dd39a00f555755eb9a7c2772e30b8d4
SSDEEP 196608:vEL6qipXt7yPHUipI/Qm2s35K4xdKBLDnLzjM33WGp:gi92fUF/Qm2spK4xdaDYnWM
TLSH
T1BE76330201997BB7475A06AA2FB39704C5013D49F801A5A9C8EBBB4593F3B9F1DC39F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c009.msi
- Size 7.1MB
- SHA256 b0db2571df528830d17a0a4dd53448014cf271f3c6a11c8f2646a077d1749865
- MD5 e5df64a5198c0791487b57e142b7d7f3
- SHA1 bc3ae6d18474b8b8f17bb4c1041ae8edf9650aa5
- SHA512 f5272862c7b37a4ef2b005b126fc825f37c652d19a28390dd54b9bdb51d3e54bf4532ab7da92a09fffb1faab98c34a4459420c9a20b7e51d8a803a1b1cea8f79
- SSDEEP 196608:QUTss0UBxNzE3NUsTsJtR4Jy4QrZ2Y9DCztRZvpNeX3Uav:QUTAg7gdUV2Jy4Qt2Y9DuP6HU2
- TLSH
  T1F976338669C47772C09FC7751A53626CB0293FC6FE624C07B9EAB6004AF372A54F2785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2