deaf7cad5b870ce1dc9c97743179b781161bd0726b102e257de9b0d8f971d622

General

Target
deaf7cad5b870ce1dc9c97743179b781161bd0726b102e257de9b0d8f971d622
Size 8.4MB
Sample260731-16kn1ascrc
SHA256 deaf7cad5b870ce1dc9c97743179b781161bd0726b102e257de9b0d8f971d622
MD5 ada3ebeb4fd4a53185474aec09409bf1
SHA1 b0586422ce8bb7b40a6c97d578312c1ffd683708
SHA512 6b270bf03b9034acbd0682419dcc62d88e9bbd81cf993676c72c8c3af07d5c034a3458d5098e79307e42c4f98bfc5e18c640ae6639c187cd424b29c674cff6ae
SSDEEP 196608:aY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezI:aY4qjnt3t0mrWDbZ
TLSH
T1D6963366E0E7CF5B059898DC07511A2ED83490246D291E873ACFF2AF71A35E17C37BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 dfc6063bf5cc6f63e13b3a343fef96496edd543202e91900841d8dbf8ad84c5d
- MD5 5327871adc8d47f8acebab9741232c03
- SHA1 82908ebfed4510c5175ce143906635c9cc77e667
- SHA512 5721e83ce72fac4709844e11f6097c391874196e8d83135a0123e7d63a03fadf8f3ec3d6c86fac8655c8e6134615a8fe01dbd474347020daa2a19122344251fe
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshV:rBjf4vFYmROxLm
- TLSH
  T1CA963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2