ffa0ae320a01bfe532590953b0aa8a9c38a87421df6e11c96dfe1027e6609331

General

Target
ffa0ae320a01bfe532590953b0aa8a9c38a87421df6e11c96dfe1027e6609331
Size 9.1MB
Sample260804-ham55sed86
SHA256 ffa0ae320a01bfe532590953b0aa8a9c38a87421df6e11c96dfe1027e6609331
MD5 2eb0f742beb2a20ec912ca546be04189
SHA1 8e8f8152712762dae6b8547fa96adfe3c8ddf98f
SHA512 867df5df5b25ee16707b6d0568a515e7a5345fc5cce0850351a204c31b93999c24ef83ecc9fd87b343353d50b0195740aa443c6bd0ac2553f71656f5f2705ac8
SSDEEP 196608:Q+2zxXisJiGdNFTHSq9ZoSXmfHlCkUy++lDxBkT+nCYE5:H2zxXjiGdjnhm9kfiDxKTGo5
TLSH
T130A633B394BDCEA5B494A772C04DEA9274FF8EB162350B02B22751171D7860770B8FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c017.msi
- Size 9.2MB
- SHA256 9a653daf95c5875771e7b145158a81c58c7db2ec07700a12cca013055ab8faa6
- MD5 445d82e9d7b5d904248d770d41d2b61d
- SHA1 ad5d97c83bb66789eb612a777c9dbf787e60f7aa
- SHA512 6115f05f872bbd2039597dd3c3492b26ad33108d79fa57d644a7d4e3d499306c6233c7173481d5704f9f76baf60449bde0b09ecce5b6ada26575b7e5b2d470a5
- SSDEEP 196608:P2s8+khACxWodtr7FuQtqOz8sJAZu2S8KuN11B+TCj+WDuC:Dkh7WodT9tltawpE11QTMt6C
- TLSH
  T17BA633D3A88E6775E087C3718147B49C70BE7FD2BA260D0273E97A052D7162660FAB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2