e7887a5be5e1b48106b048a9196ea18102251e93ea0665bac105b8b0f77acf25

General

Target
e7887a5be5e1b48106b048a9196ea18102251e93ea0665bac105b8b0f77acf25
Size 9.5MB
Sample260804-e9g7dsv1at
SHA256 e7887a5be5e1b48106b048a9196ea18102251e93ea0665bac105b8b0f77acf25
MD5 4cf65907d3ae20a90d2b767cf10be24b
SHA1 d53f6bc05322a862d239c2ecabdac7857ff49d59
SHA512 94222290e7c72a288fc2ac7f1c146ae26eec06b97d7d95d3090d038f6801484e44fd826ba2edbdefa852ac7114d610c7c82ea980447c0f449f40a92df6705875
SSDEEP 196608:C+a3PYBhkdlq91dJ7tWVAvXxzrWMggaDz9Yiau7WyGQZlK6hhU:faIhIq9/J74VAvx9ggaqFu7VGQ9ha
TLSH
T1EFA633BE8F346B19781FF76F9AF9076E54A38099E8F15DA38D429203541358708FEA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c012.msi
- Size 9.6MB
- SHA256 c50a0584fa6cf525593e7d094a4333f9d83388c2344f079a4282ff557e598a47
- MD5 f28fae1575acc4620a13319a2ea202c2
- SHA1 879e869bf2c9531420d782b8bce3c424b6fb47e8
- SHA512 11b00071d6ca14307b92f4fadb908e9e3a553d8baac3531295a07ebe6f9ad60a2c8bc0a66a5ccc94c46ab21361b0e763db61243fad4b42611ae12b7992e4120b
- SSDEEP 196608:WN71yPdClb5LQcR/cSG1ZxRdwOQWKdV/giS+RmeMx/lKAHJc:48d+JBUSGXxHQWK0V+RhMxBHm
- TLSH
  T1E3A633A57E592B30E06BC7B986A6166D7D397F81F9B14D173A8733001D336260EFA708
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2