30a6c5d118971060ab7f134b4e3ea5ecd3489b90ade99998a158f2865065ade8

General

Target
30a6c5d118971060ab7f134b4e3ea5ecd3489b90ade99998a158f2865065ade8
Size 6.5MB
Sample260804-kgz5ds1vas
SHA256 30a6c5d118971060ab7f134b4e3ea5ecd3489b90ade99998a158f2865065ade8
MD5 739a56cfcca9807e13f5168bcf5e2724
SHA1 85f3ed00b08693e6452afd919bd7741c950ff19b
SHA512 0a9ebe2ae0c4f17738827d5f56d53ccb69df1eb5374d3ea973373e35fd1596c1b4ae9c09ece680bf491b13c16c99a9a8c21366d0f9c54ea4b3f4d7af33703ac6
SSDEEP 196608:CaEmTXicX4mg0HakpMUnE5hLrSWOrX6vzB7c6mY+UHiNsjoJ9ius:jEqxvXM42SWRzW6l+UzoJ9ius
TLSH
T1076633D24F1AE4C0FF944BE1785ABCB566B118BAB04430E4BBD5905B3E0DB0B67D4AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c018.msi
- Size 6.7MB
- SHA256 47e843dcb307a1020d206bc5e4d0baa88c9bd757879368f35aae18324014c62d
- MD5 b6d466ebdc43dac0beaf4f9c4b06e6c6
- SHA1 46020116bd2d13662501fe4893009bbcf199b3dd
- SHA512 22c1616e42a54973581442d58133f51d1acef32bb47017b1c0b452f99adb8aeede146f527e48d9d55825eae43847ffc865c30903bbbceca6a552200a89c0fcaa
- SSDEEP 196608:aKt9y0xEMSc9+IL8nPZyaWV74hdTQcwSMiFkJw9IJF+w:a8LvD8ByaJhScFMilIJF+w
- TLSH
  T1436633C1BE8A6770E18BCBB0510265BE32763FD2BD118C567BE5320C7E3A62619F5790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2