6de0c19ec73d05b2f518c7898679cb57c5c544bfc270c770ff0d4f81a0191a51

General

Target
6de0c19ec73d05b2f518c7898679cb57c5c544bfc270c770ff0d4f81a0191a51
Size 8.6MB
Sample260804-h3j9ystere
SHA256 6de0c19ec73d05b2f518c7898679cb57c5c544bfc270c770ff0d4f81a0191a51
MD5 ea0cc87566b093d09080c46b80124bbb
SHA1 4a4c88d2baab751bc3049f8d28b5c9120b3dee18
SHA512 cb8bb0a93120b7e244d44993bed455621ce2f8783e14bb1a17d7b504135df7234bc2d2425353743b0fca41acd21f4d2bf7be0683c1088e84489f8b614fbdbb88
SSDEEP 196608:R6VxcA6sOHgSNMePXgo26jn2Ne3asjW2LOt9MnrGZpDDoCT4Ma/fsFEW:R6PcAYHlgf6ye82LOtUGfsjsFEW
TLSH
T17896337863BFD8094EEFB98948288A8E8579E45A05CFF77574C3701C6311BDABA20653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c015.msi
- Size 8.8MB
- SHA256 e7f043baea9539f58e95a9261552169fc21380985f2704dbb11c567e06fdea34
- MD5 b98fb49d88770d013cf3f567e623f6b8
- SHA1 ffbae849d09c1b4baa0c8c73d048fc8a501a6f73
- SHA512 3ebd0de5458c1d325415dc8aff744fc8ddd8d8d10901f0ea6c9235b90d7c21321dbed76bb417f9a600888b556f0730777f013aeee08bf27ce96c8a4e5c38aff0
- SSDEEP 196608:YbOyhL0UYsIHEkq6cxk5z2OmKz+tubKAhI2Lyb9A1fE5/xNueT4iqHXYFIN:jyB0UQHvdQuA2LybYEJMhYFIN
- TLSH
  T1A29633983ADFAB34C5CBD3B44401A95EBC2D7FC9396B9D0674DA39042B32A1B9331356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2