becac89f4de5119339ce63e9e2911b816c4744063c5466f1a52e3b737f99ea58

General

Target
becac89f4de5119339ce63e9e2911b816c4744063c5466f1a52e3b737f99ea58
Size 8.2MB
Sample260804-mj55jacp9y
SHA256 becac89f4de5119339ce63e9e2911b816c4744063c5466f1a52e3b737f99ea58
MD5 cd3e454511783d90ff2bf346ef8811ed
SHA1 fd568c6478ccf5510c29b28d56204bc4a334bee0
SHA512 357e6422559d634e31eaa98e56996eff0769233ef1bee4be583db6a54804d9a16b62439c2f6ce65eca3db69b1bd035cc0d5524fb1321d5d2522b7b10f9e9c2f4
SSDEEP 196608:nthYhWRrggZ08av4JJuM43nbXNA+8gR1OsjpcmF7O:nbUWT08ayeTNA+z/KiO
TLSH
T1A386331AFCA22A3D23FD7E2D316054B40DCB3D960960DD9AF71A5BF8042D701BC55ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c001.msi
- Size 8.4MB
- SHA256 bb07eb3fbc0bbc57cd4a4b35301f3898f7faeb477b877326de4bb7ea62b49cc6
- MD5 629b5199d566729cee19e35f1cc75377
- SHA1 31996d0793e858ec1ea495db1e98d174546b75c5
- SHA512 8f2f8da97a33968d58ac69dffdc281ef1c8436310be5e51c52ebf84a520a5378132e56b02701a2dd8e8773da17ed5427b6db59356efa54448f16cc2244fcf346
- SSDEEP 196608:frd8CFiKmjjhir+z1Lh0skuJlpNkwCMBPAMb1I4PAma:f3iKmj1n5pNkwFZGXma
- TLSH
  T178963395BDC92335D0EBD7B6201375AC325A3FC2BE729D527AAC3B200D3231568B6758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2