6f022ade5e2d6a3d2f5f55729fb9ae4cd03393d38712529787951c915f043a80

General

Target
6f022ade5e2d6a3d2f5f55729fb9ae4cd03393d38712529787951c915f043a80
Size 7.1MB
Sample260804-p2a38aw1ez
SHA256 6f022ade5e2d6a3d2f5f55729fb9ae4cd03393d38712529787951c915f043a80
MD5 6d13226f2c9f14868bba64977a571326
SHA1 4fc32002038038aad1a445edf908b5d4458e2ca0
SHA512 14ba731efd31ae54c42c0e7c6d1cf05a68e6d66f4d233a3f5a18b6c680b2195b97eed7f8d2f5a05689c7b120a0ea1e275c2d287b7379765660eed048a3394eb2
SSDEEP 196608:r0/Pscsxn2oMoj+8ooYOXl/ooXyQojX5NbgCITNm5Nj:rtxR+3e/ooCQA8CsY
TLSH
T136763314A34E36CE18F260BB6DA1FFC53C57B469BD37C4A0427C5C7A3A05AA59C4A07D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c008.msi
- Size 7.2MB
- SHA256 ab65d34392ece198f64af5dd05aae42954977e9998b89e3e41de8cfc6aa54f0b
- MD5 ce14664e6d17993c30463c71847608a4
- SHA1 d5268eb39470cab98d6c63463ce7d1252b2c4919
- SHA512 f0cfdc827c9801c75d72d091a439bb8788e572d14406f49b8882f31ab98607ffa71513dddc741e88a06882172911bddce8a103f6304bcca6c5295282db6b45e1
- SSDEEP 196608:eVGI6u5d086jPSC6a+G0OpujsEt+2+lXzfDO6gvzufhM:eYJjZgMujsEw2WS6k7
- TLSH
  T10C7633C1B88A373AC1E7C3B25582B89D7D2A3F59FA338C1633AC7E142E727154976149
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2