841ed5457d2372f6170c8963ffff37de723a4888ccd2d1dab117d74fada99926

General

Target
841ed5457d2372f6170c8963ffff37de723a4888ccd2d1dab117d74fada99926
Size 5.4MB
Sample260731-nfp5kshd63
SHA256 841ed5457d2372f6170c8963ffff37de723a4888ccd2d1dab117d74fada99926
MD5 22dbafe9b6138f02ea0bb4cf3f7f76df
SHA1 d01aca014938b77bba58f50e168eb72e29c99f18
SHA512 af1829eb950d02e86847039e7d47f6d477b9a2aac99327caad53ed262fb3c4c57b20331cf819615bd76172bc697877b152ed85511638a54488248a4b2e9ce381
SSDEEP 98304:4ZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1w:JyBOALr5ZXSDAmZ+0w
TLSH
T1E846331AA9D7FD26DC43FD6471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 fde1deaefdbff8130448059ffba91a780b905e11f31a1b9d335f40ec49180553
- MD5 1cbf715deaf05f2cef0385802d8ce7d9
- SHA1 d8224fac1dcc52649fbe61c1463db2f495fb18a0
- SHA512 fa8b162957ce84071a5c06937ffd2c12295fd2cbdb6a835ae4a76cc83f21ecca1bbd412ddebd63a642a814690124c0e34fb6aabe0a89fe19968105a648aad4dd
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8fw:z8H6F1MJhTZ3Qe8i2XkghA4V6Yw
- TLSH
  T1645633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2