fee085bd010f4243528fae375c7c57a6b597e2d75da536ecdf1da6cd0891c7cc

General

Target
fee085bd010f4243528fae375c7c57a6b597e2d75da536ecdf1da6cd0891c7cc
Size 5.4MB
Sample260731-mfkdna1vb1
SHA256 fee085bd010f4243528fae375c7c57a6b597e2d75da536ecdf1da6cd0891c7cc
MD5 030904236459b6f168bd42312a6717d5
SHA1 0e7019a19a46ea095a2ca061b6f8f898705078aa
SHA512 2c159db1060d98bb8d2db6fca4b692b1d491356c3a9da57e2b29e7cca2e083e75af3a6a9d7a0083488bf4474dc8e038361774a509677432839c978d947f556fa
SSDEEP 98304:KZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1N:ryBOALr5ZXSDAmZ+0N
TLSH
T12B46331AA9D7FD26DC43FD6472239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 2e878b67c8c6bbe68078820ac51e5baea1af60c49d7b8d947d4bef2c978a7711
- MD5 e1c498a67419ae2716a6bf11d9445edb
- SHA1 62df38360c42580437f7079fef44029dde4689c5
- SHA512 500e73fc4628c0d22e080a7b080c14b26820ae44ed7eacee0db1456e0dfe5e2b5e4d158ef6a0274d92303c84f32caf05e0942cc879a15bff765b0c499bea9317
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8f2:z8H6F1MJhTZ3Qe8i2XkghA4V6Y2
- TLSH
  T1505633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2