0c459b032ac8505ae69657ac8dfe72eef52ef0774dff1a3b497bb7c1ad024562

General

Target
0c459b032ac8505ae69657ac8dfe72eef52ef0774dff1a3b497bb7c1ad024562
Size 7.4MB
Sample261014-hke8aafa44
SHA256 0c459b032ac8505ae69657ac8dfe72eef52ef0774dff1a3b497bb7c1ad024562
MD5 150e6387f53503a4d9070df59f1d1e8a
SHA1 40bedd693e3c2c9afb07e18dd767ec4a5e231616
SHA512 a22656789b1f475c706d712e908e7585ecad901f05764acb97710fe5b852adb5683f7ec8ca534e16f1d23a3bcdac672ef16be17bb4ef496a1d2272f9ad1f4a57
SSDEEP 98304:NO0rar2bB3tYKbfPCnxwrxJnrppTb7j0cshV+C6wX+khRFGbHh97O8xX2/2e+jc:Xe6+IfPCnxirppTb3gVqwX+qSbtc7T
TLSH
T1377633BD7023A33DDB76CF85990AF23744D58896202C9177321C669C26C9A9B089F9E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setapp.m1.0.09.msi
- Size 7.6MB
- SHA256 6ad18bf0fcfb4d2f1acc408b16a57b35020820a1599f69fc143c0f6689778216
- MD5 22ad045e0e0ee3fbbe95ac83271186fa
- SHA1 22707649d6cece7cce44b2c72da0d8f29563cf9f
- SHA512 bab19a6402d10f666bea6cfa1629448dbce63a31e04795c58ae390f8b88c024189cf35c088db6f1f9da12789d4391be0adbf3911644876a4a111f48b59bd79e5
- SSDEEP 196608:qq8VnNIAoDvM2pxkZ3arbpntrl1gUZ+La1Kwud5+Xr:qq8VnsxvlTUm125sr
- TLSH
  T13A8633D678867774C193CBB58406F13E38297FC6B9759C223BAC37042EB3626057B686
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2