a47dd69f87d644723116fb559674fae65e43c668bb5aa1bdfcb91589f02e0ad4

General

Target
a47dd69f87d644723116fb559674fae65e43c668bb5aa1bdfcb91589f02e0ad4
Size 9.1MB
Sample260804-hc86dsx1cs
SHA256 a47dd69f87d644723116fb559674fae65e43c668bb5aa1bdfcb91589f02e0ad4
MD5 34c59df1d2860412303b1911d3823289
SHA1 738399df7ced5c931a3ac0c567b944d39f96de04
SHA512 c0b1fd215d0a6e15b1c18462ef788800d2b0f5505c85d547c513afe79122d3bed55cbf37edf5e90363db56c047e8956fe65917a1021def4d10d6224a18b7387b
SSDEEP 196608:K+2zxXisJiGdNFTHSq9ZoSXmfHlCkUy++lDxBkT+nCYE8:F2zxXjiGdjnhm9kfiDxKTGo8
TLSH
T17EA633B394BDCEA5B494A772C04DEA9274FF8EB162350B02B22751171D7860770B8FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c017.msi
- Size 9.2MB
- SHA256 5ec6a3870f725e2861624ccfdc7a57c2ed130f4ea4431993e1e45d4412982a71
- MD5 f8c9ba10e1a6b14c25441f7d279bbe06
- SHA1 6c68c02b32b907be62fe52a74b9157e183b047a6
- SHA512 fafcc033d02b094ea52267c0ea7ebda425b824c4b05533b2766eddb1e4944be27386801a415f7382f04ec17310b3fc2363c8583c1a86b7b58d55856917dac59f
- SSDEEP 196608:P2s8+khACxWodtr7FuQtqOz8sJAZu2S8KuN11B+TCj+WDuA:Dkh7WodT9tltawpE11QTMt6A
- TLSH
  T126A633D3A88E6775E087C3718147B49C70BE7FD2BA260D0273E97A052D7162660FAB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion persistence privilege_escalation ransomware discovery execution exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2