63f3a014a9e0a2f2f8e409e9a77e1ff246b48a2744a21d8dae8084b4c6dd4adf

General

Target
63f3a014a9e0a2f2f8e409e9a77e1ff246b48a2744a21d8dae8084b4c6dd4adf
Size 9.0MB
Sample260804-h1bvsstemg
SHA256 63f3a014a9e0a2f2f8e409e9a77e1ff246b48a2744a21d8dae8084b4c6dd4adf
MD5 c794cdc90e459243963d50c9bb1030c9
SHA1 499852ed728ca4eb954701ccb220b8dc778c2892
SHA512 43414fba576b6452f9673f89692be08fef33baab08c3dcab6c55b9b9cb6b76390ffb54e92895512940af2cf35ef08a71b8e6f4a127dbd0dae0eae46410a0f8f9
SSDEEP 196608:FclyHFetCi6EhIfRyWilT88aKBoeNr9OIEN6TmfgP4BhTGSuW0eydsUh:wmFetDKYhcKueNrKN6Oh660eyd3
TLSH
T14696330C6C298663D3BB30665E3983ED17E0EF085189693DC089D67C96C59B3F6FD892
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c016.msi
- Size 9.2MB
- SHA256 6427b9d4f3e73d7d9f121d0c56be6abc7b068830762a1441fe25a47c603a2127
- MD5 4a66b8385cdc257ceb961a918d124c96
- SHA1 0ec466284af5657127410a0ddb2fbd0be34daa4a
- SHA512 57b70082fe7ddb13acddc81afde7621cc945a5a2c1be265601d7ec6c78d7d87a5994e204fc50e5b9ce315243cf7bbc2610b6f60a255ad34f5f4a53b0ab7fcb38
- SSDEEP 196608:7QOU69f3K0uihKqNzfPkAeg+QANG0h/fG44XKFMpwPqZbZI6ooQm5j:Nb9f3bU2zUgAA0h/wXKgbsoQm5j
- TLSH
  T1C5A633887C462336D09BC3B1862762BD3264BFD53B214C07B2D9B72C6DB763261F6646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2