9a3c23488ff0adc6b3741ccb5f034c971ad63a66679083ab01df473766a9fa55

General

Target
9a3c23488ff0adc6b3741ccb5f034c971ad63a66679083ab01df473766a9fa55
Size 7.1MB
Sample260804-r3fffasgnh
SHA256 9a3c23488ff0adc6b3741ccb5f034c971ad63a66679083ab01df473766a9fa55
MD5 2ea1ec4cf0f31e03f1792927402f3887
SHA1 cb5e13eab7f956816fb60e29a82ab41366345e1e
SHA512 25cb2addde89fa2ed3074ffff066e900f7fbbb6270359e8dc6b954d23c3a6bdf63d68dab79da02724fd60ede06ab4473395926405e55c4051f6be24b9b52042d
SSDEEP 196608:8cEnAospqeeZedXYYp5vNHeKdU1hZc7X4o6LK:GnrheeZqIYlVdUO7XN6G
TLSH
T1327633DC1B95ED1B1AC0C627BD8EE01BA69C5C3199F6DDAC8391638C77B2931A11D833
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c005.msi
- Size 7.3MB
- SHA256 1a3c0abef50670c1d1e918cdd5080fc0b3fd72499d21f04cbeb3841601848acc
- MD5 826227dd8701a7365f56c04a5837fa52
- SHA1 51de72426fa1b424ca05881cac28651401301f13
- SHA512 c08470108485ccf94db6ee111b3d66763ab70e9d12deb9d39b804297191f5142c71442a26157fe6cb45f5471c8b215c10a4b7b4c00406c886da0add65a3dd55a
- SSDEEP 98304:cQ9Z0Uu1Hgeti3AjLXoCyUXkego6d5V1NHe2vzL7QkuD9HcoaNwOd9EGC6PccG:ck3e2A3owXke45VrHeIfUJ5HcvZs6VG
- TLSH
  T15C7633D46CC6B736D6A7C3B1988B652D7A293FD07AB38C0E77E436042E333255279612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2