650dfb5723b74b18961b42d7b4d45d8ecd08bfed35ea43522b872f603f32a721

General

Target
650dfb5723b74b18961b42d7b4d45d8ecd08bfed35ea43522b872f603f32a721
Size 5.1MB
Sample260804-gl353adh86
SHA256 650dfb5723b74b18961b42d7b4d45d8ecd08bfed35ea43522b872f603f32a721
MD5 1cc3527982f57c57ce3c29d6d410f2bf
SHA1 0b984ab1ae809afc211a91bc6428894c7e762d4b
SHA512 a310b726593e787cce128f074afa9238c18b41b0d3a17e6b1905081b330535f37cd7776d0db4582cd2c2b5c9a5f287750ab37ba0f7b6f28f827e42a1e4a24cda
SSDEEP 98304:iQwF0/Gb2Lqsm4ZMEnmf3sM9ZkP2U3osmX5hBYR5Wq2LjDSdxXSTb:5wF0/G63m3Uq7UYsmX5Iqq2Lyd0Tb
TLSH
T1244633C09471AF608B4495E6C26667EC8CA8FBDA7967DF5F814BD5263D040FAEC88C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c014.msi
- Size 5.3MB
- SHA256 a6377e384d032783d8cd22d371f7c983dca2de11c0367645fa7be95da5d88458
- MD5 5fa7cd96aa6f0d3b54e73dbc920c570b
- SHA1 87e5bfd9496492f5aa6cf8355fd955cb0ea965f0
- SHA512 4547c99d1f212e6b3de6154a44db7ed3dfe405641fa1e3dca9ffe1b7fa68500a5811e970b3c5a1821c4af94b8bda696f1d1ad0e8caa069e7542b67162ddfdf07
- SSDEEP 98304:xRrwSKgwM9ZRYuX8/IE443gwH4f/w8TFRztryA47lBMwl3kYk1jZSLrXQxk:xRrvHwMCuM34Dg4Ztrp47lywqYk1QLsC
- TLSH
  T1624633C429C66B30C05BC7B18217B6AE716D7FC6BE329D0A79DEBD082E3111B5875B09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2