7fe8e40cc5fc00038059e0d016c3b7193e200d9b86000bffd0ce751e3e7fdd33

General

Target
7fe8e40cc5fc00038059e0d016c3b7193e200d9b86000bffd0ce751e3e7fdd33
Size 9.0MB
Sample260804-h1shjsfa66
SHA256 7fe8e40cc5fc00038059e0d016c3b7193e200d9b86000bffd0ce751e3e7fdd33
MD5 e2fb41b230c70a9510dbfaf81fb34822
SHA1 a564a25c68a97788cb54b09417f8cbe09427c0f0
SHA512 f8631ee4e83701cc73493a255d9db94252b588583db49340b8ce90be4cc46a2e940ff7a9caa99415af301b22ef06ebc262f0949dfe23f768a2f83716b91692fa
SSDEEP 196608:tclyHFetCi6EhIfRyWilT88aKBoeNr9OIEN6TmfgP4BhTGSuW0eydsU8:4mFetDKYhcKueNrKN6Oh660eyd6
TLSH
T12896330C6C298663D3BB30665E3983ED17E0EF085189693DC089D67C96C59B3F6FD892
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c016.msi
- Size 9.2MB
- SHA256 58846b74695064852ab7658703fc40b5d4d70dd90a1c6cabed216c9ee795d559
- MD5 466daebdf532c7051258764ad60b20e4
- SHA1 1b56b45fb5aa0366bea098b4dec7f1c06dd70ff9
- SHA512 6259a7ee07f186b62157ddeb02da22c8a1edb687479688965be2e79804e3bf82de12b62a59c10007e6a525fa764d0aa8404e411c5a1f23cf73ed03ce6d21b43b
- SSDEEP 196608:7QOU69f3K0uihKqNzfPkAeg+QANG0h/fG44XKFMpwPqZbZI6ooQm5f:Nb9f3bU2zUgAA0h/wXKgbsoQm5f
- TLSH
  T1ACA633887C462336D09BC3B1862762BD3264BFD53B214C07B2D9B72C6DB763261F6646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2