d659b88276ed6644b38daea72f63bfc065687a2a03c100183884f9b9114b566a

General

Target
d659b88276ed6644b38daea72f63bfc065687a2a03c100183884f9b9114b566a
Size 9.5MB
Sample260804-e72s1sfq4w
SHA256 d659b88276ed6644b38daea72f63bfc065687a2a03c100183884f9b9114b566a
MD5 2b33863acadce1013fdf69d69f0e0075
SHA1 cc961677652b7f163cf1a8993ea3c65c85fdbb01
SHA512 0a99586276630def4dceccdcd7bb9d0cc4504732557c7df6561d635c5b981b7a986eb8541b5a94fa12ce5fee9aba69ca3e5fdb2e125491d63b085fb5cb32c6c9
SSDEEP 196608:L+a3PYBhkdlq91dJ7tWVAvXxzrWMggaDz9Yiau7WyGQZlK6hhp:6aIhIq9/J74VAvx9ggaqFu7VGQ9hb
TLSH
T14BA633BE8F346B19781FF76F9AF9076E54A38099E8F15DA38D429203541358708FEA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c012.msi
- Size 9.6MB
- SHA256 8ff5817abd31cddd6e580f52aa12aeede544418fbb3085f180799ca794257aeb
- MD5 61090c860eacb3fca08a3c2069bbf62d
- SHA1 88a36dcfcdca0089156bcd2041260614eec66492
- SHA512 33d3557dc9522c0f8aae580f4749a9763c394f5d9ea9048ff393e96410b7fdd9bd99643aa1f45f23d0809047dc39b845f8c2510eb9bc9611b6adb87d4c01fc51
- SSDEEP 196608:WN71yPdClb5LQcR/cSG1ZxRdwOQWKdV/giS+RmeMx/lKAHJK:48d+JBUSGXxHQWK0V+RhMxBHw
- TLSH
  T1FDA633A57E592B30E06BC7B986A6166D7D397F81F9B14D173A8733001D336260EFA708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2