50fcafd631b643e5c92146b7d676ed524575087057fd7cc9df1e53720e7c5f2e

General

Target
50fcafd631b643e5c92146b7d676ed524575087057fd7cc9df1e53720e7c5f2e
Size 7.1MB
Sample260804-smv2matbjf
SHA256 50fcafd631b643e5c92146b7d676ed524575087057fd7cc9df1e53720e7c5f2e
MD5 14c0ab89f4d35061044b3a4fc827c24f
SHA1 c4ad9029f6d33c31cdadb7617e6f96f067c981b4
SHA512 ea1850793167b1de59b107330cf9b1eedb5a2b9c6ff0accd9efeb763ef7ee829ee66490d36ad21d5ebccc480b9f0d715708f9e2ad8c0ca628eab264b1a927dda
SSDEEP 196608:LcEnAospqeeZedXYYp5vNHeKdU1hZc7X4o6Ly:DnrheeZqIYlVdUO7XN62
TLSH
T1747633DC1B95ED1B1AC0C627BD8EE01BA69C5C3199F6DDAC8391638C77B2931A11D833
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup_n0c005.msi
- Size 7.3MB
- SHA256 ae54219631eeecca22952637e5b1b3c084ee75c401a0d7e1b7f24f6cbdd8069d
- MD5 524fe9f16cbc8dcde787c0877d8f37b3
- SHA1 f4b1767f77fcebc89c81cab954cb1868bd58fa4f
- SHA512 27d2536cf013c6c513499139ce2542350e4596697d051b70196e060d03d2d47f1b55b0060d57a067f1c63410915da4f82e47e17e523024d2d3bc05d41c84d1f8
- SSDEEP 98304:cQ9Z0Uu1Hgeti3AjLXoCyUXkego6d5V1NHe2vzL7QkuD9HcoaNwOd9EGC6Pcc5:ck3e2A3owXke45VrHeIfUJ5HcvZs6V5
- TLSH
  T14F7633D46CC6B736D6A7C3B1988B652D7A293FD07AB38C0E77E436042E333255279612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2