39a7918d19e3b14f150b7bfb31ab1fe63807f653acfb871ac12459385c800697

General

Target
39a7918d19e3b14f150b7bfb31ab1fe63807f653acfb871ac12459385c800697
Size 6.0MB
Sample260804-lee7wacj3w
SHA256 39a7918d19e3b14f150b7bfb31ab1fe63807f653acfb871ac12459385c800697
MD5 babfe09dd600fb813c6b012bcf050e72
SHA1 15cadf3f97fe4be2743c1ac9631a58d2f743c5ab
SHA512 28e607b1c3ad6ed524f53f9e5263a381e03f4136c29bfe30a70d268fc9073783838ae825f93c449766b8a29341d6f8a4e702775779674a9a4e609fac0e01328b
SSDEEP 196608:NEgsBj+QmRNkCpeYLQ9MEWi9ZmLeFAXcuoc3e:age+QmRNkCpeYLQBZJ8ocu
TLSH
T1835633BA1F31F0BA6AAB044C32286BFBC5C53A34D76D96A0AC75E57FA15C9474723D00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c003.msi
- Size 6.2MB
- SHA256 cd27572ba9dc8c6736fd3fcc1158c569abf3b7824757491bc94774132c5d9af8
- MD5 d4a7f58547370c98d88b4f8c654e9096
- SHA1 86f134b30120e76982c2a23eaf49e8b1ef4ce87a
- SHA512 398284efc4e38a5a8c8da908df4474f00562f88d99d316f695ca72817fe277a14988b128484ab2418838ffa8449dd88ec9851368e9358b14f930a177d765d7a4
- SSDEEP 196608:5wh8tG6nVwkSRBClBZEiWo4bmSqiPrQZ0ledcKUkKA:5RG+wkSRBCfiHrHAUkKA
- TLSH
  T1B66633D43D8632B1D0DBC3B8552233BEB1543FD0FE668C62B9A97A291D79B0709B2741
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2