c6c76b0a5c0115c449e065f283daf232504b72746e267c46b845b7d1e0f50f27

General

Target
c6c76b0a5c0115c449e065f283daf232504b72746e267c46b845b7d1e0f50f27
Size 8.8MB
Sample260804-cz861sbf49
SHA256 c6c76b0a5c0115c449e065f283daf232504b72746e267c46b845b7d1e0f50f27
MD5 34276a852573bdb922871e8fcdb5d518
SHA1 4ae1b6b2e16666db44e7ff9e8bccb5992408ef2f
SHA512 560a31cfe8368edc7e3d262c54ff6aeac10aba5fe75ce7200f3ed4c8d3e23293ad8bfe63055a9b20f911da90c62c632b9d7521deacad96f3d2649af15b0943ee
SSDEEP 196608:6CtLFi80vm8QFjPeXuAWRL4VB1C3hN5H3ma7W5U:/JiD+56XubRYg5HT
TLSH
T1519633FFA7A2D448CC6965211D96D41B80BDBEFDFB0C9697B8D26617CE34730901AE08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_b6j008.msi
- Size 8.9MB
- SHA256 26ed34ef8a4a33e21e09bedabdb0affb911d1d96433d7a6bd1b0e7aa3b02c9aa
- MD5 bc21feda21b99f1875e97a5a4e06e126
- SHA1 eca40e74e961367d938079a6b6b1587a40cbeefe
- SHA512 be4f29a3b28f24609b577fa850b7f2e76a33f7d1f6d8a98e8be868d800f90c31a1b5f03bd586282292a24560dc7954ac4e15a96038fe761c36426cfad87354fd
- SSDEEP 196608:Ecep1tM82vE4eTA8frv+Tc+YBlqpDHO/BZRP3MEriJ3:gHMHskPTcXBCGRPi
- TLSH
  T1F99633EAB9866371C09BD3700553A51E706C7FDAFF2A9C077AE5BA015E32B215037B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2