b35f0320389c4b9c88036dc5d59f9e3aaa223d428b212f721090886b5e05e316

General

Target
b35f0320389c4b9c88036dc5d59f9e3aaa223d428b212f721090886b5e05e316
Size 7.1MB
Sample260804-nx1bwadp91
SHA256 b35f0320389c4b9c88036dc5d59f9e3aaa223d428b212f721090886b5e05e316
MD5 56611034e0b3e49c0915b0c12234516c
SHA1 e5cce22b8f11c11616794b33754ad630c5fc97cb
SHA512 776bc1b99425c21fa87aa5f9d047f3e29857787f0bf70943e677f36da2e309de2faa1bd1b04ebcc44569ebcbd960ac26530701f285dd9de275cfc547ddcf57c2
SSDEEP 196608:70/Pscsxn2oMoj+8ooYOXl/ooXyQojX5NbgCITNm5N6:7txR+3e/ooCQA8Csj
TLSH
T186763314A30E368E59F260BB6DA1FFC43C67B169BD37C4A0427C5C7A3E05AA59C4A07D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c008.msi
- Size 7.2MB
- SHA256 d3a22c04bf335805365c259ea8d9e3f1d6922b6e09be7700a5c97812105481fb
- MD5 afd62fd36e245d015a15aab67647fb49
- SHA1 7a7f34b51a97ac976df3d0284e787ec550bf8914
- SHA512 17afa1bfb977294da91abf8c10288994b4d624783057a5eb9acb4d173cc6d6e58fe476ec171ce8ad7887c46efbdbc8fe72c7e3cad2453d98a44be4df670fa5a7
- SSDEEP 196608:eVGI6u5d086jPSC6a+G0OpujsEt+2+lXzfDO6gvzufh6:eYJjZgMujsEw2WS6kN
- TLSH
  T1E07633C1B88A373AC1E7C3B25582B89D7D2A3F59FA338C1633AC7E142E727154976149
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2