25afaccdf904c97fabdd897cc3e00de3614b0a1debfe3a443a7df2a615e2b6c7

General

Target
25afaccdf904c97fabdd897cc3e00de3614b0a1debfe3a443a7df2a615e2b6c7
Size 6.9MB
Sample260804-m6ewvsaa55
SHA256 25afaccdf904c97fabdd897cc3e00de3614b0a1debfe3a443a7df2a615e2b6c7
MD5 4787e9267b0242978054d433628f0c40
SHA1 346f6fc9c918db780fed88822ad9614d9c7bbdcf
SHA512 758d2a90b7aa2e06235a8bde86719afe1df2a49950f98c583d1948a31f19ef43892e0bdf4d8452d64e7564cecaaba33d30af54e4c056e3a6652daef75fc8a56f
SSDEEP 196608:8EL6qipXt7yPHUipI/Qm2s35K4xdKBLDnLzjM33WGT:vi92fUF/Qm2spK4xdaDYnW+
TLSH
T18876330201997BB7475A06AA2FB39704C5013D49F801A5A9C8EBBB4593F3B9F1DC39F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c009.msi
- Size 7.1MB
- SHA256 00f23b3e2865f41eccfbfd1ec2eeeea78edee626b523ca66f7b7edd7efd83338
- MD5 2a41c95d1d4a88a58eafd64786d4bc3e
- SHA1 548f53090794446693cb2f9e97e358ec67103c75
- SHA512 7c32d41628b4f00a230cde7927811c065f487e4c6c539a4b6972b424e9562a4c7246885dc40b902044518922160118c71386b274d241d32160cc5afb375cb815
- SSDEEP 196608:QUTss0UBxNzE3NUsTsJtR4Jy4QrZ2Y9DCztRZvpNeX3Ua/:QUTAg7gdUV2Jy4Qt2Y9DuP6HUm
- TLSH
  T14276338669C47772C09FC7751A53626CB0293FC6FE624C07B9EAB6004AF372A54F2785
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2