4d6f5295556de20e72d89b03865d23e3c3ecad05c2282455dbb0a8ba8af928be

General

Target
4d6f5295556de20e72d89b03865d23e3c3ecad05c2282455dbb0a8ba8af928be
Size 9.1MB
Sample260804-hvd3zayvfv
SHA256 4d6f5295556de20e72d89b03865d23e3c3ecad05c2282455dbb0a8ba8af928be
MD5 69b3cd7300e8d359925e70d52f4159c9
SHA1 4cdce90d6beb05e693d396ccef7f1d3b51156b96
SHA512 47b741c7b62a95ca10ea42344e04ea99287161b7110f55d7bb301d9aa5275f93084b3505e9a590adfbe399457e833e2a049ed7574da97c977da301024887018c
SSDEEP 196608:8+2zxXisJiGdNFTHSq9ZoSXmfHlCkUy++lDxBkT+nCYEI:b2zxXjiGdjnhm9kfiDxKTGoI
TLSH
T129A633B394BDCEA5B494A772C04DEA9274FF8EB162350B02B22751171D7860770B8FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c017.msi
- Size 9.2MB
- SHA256 f6dca266faffc24ed086498ea43345a27d790824206a4a0495f6013249f53786
- MD5 105c00c18b10f3ce8a6d1d29f315f107
- SHA1 65d9761d7baa672bdc021df19b3e8a258cfc82c1
- SHA512 1ce27eeb663efb7981c0eca7cd0927c0c20fc6dd43a11bfe26c49a9f517e1c6a087ab1f3c9024aec9aa5d9fa3718b3cb0df071b724186d376257aadbc73c16db
- SSDEEP 196608:P2s8+khACxWodtr7FuQtqOz8sJAZu2S8KuN11B+TCj+WDuR:Dkh7WodT9tltawpE11QTMt6R
- TLSH
  T14BA633D3A88E6775E087C3718147B49C70BE7FD2BA260D0273E97A052D7162660FAB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2