89987e9384a6a93bae3994799864c06a502a15fb9a24dab4e38e7ca1d989e0c7

General

Target
89987e9384a6a93bae3994799864c06a502a15fb9a24dab4e38e7ca1d989e0c7
Size 7.6MB
Sample260731-phhc7as1cy
SHA256 89987e9384a6a93bae3994799864c06a502a15fb9a24dab4e38e7ca1d989e0c7
MD5 8d35f0dd868478876f84453e22a8cd1e
SHA1 fbe1ed46160f41cf698fd6103b1fc2264bd8a7a1
SHA512 2a387962206dbdb7638e01af37212f35258db9763dbb0f02707f20818d9f7f650ec0aeee24e15427c268b8f682c371cf4c94dc26e6cf87596a66e0da1d6e56fc
SSDEEP 196608:/CzeUmVXJaHB3T9TgmQ3k2hWUw2bBSH8pgCgSzdNOgnQ:/CaT2B3ZTg5vzboH8j1mgnQ
TLSH
T14F8633C0BD8B95BA75CDB347DF60900BE62100E12CC529EE644B3784D8669FA3FAA5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd015.msi
- Size 7.8MB
- SHA256 e39d4500a13184a07d18e6f066f9fb2777829b5f47458220dcc1e6ee6c32393d
- MD5 3c3adcbf648a64250fdf0bd93991f902
- SHA1 7d1f5cd349d349ebb2f9b1c889b7f328b688c921
- SHA512 f490de6e0831c188715e3a06e44ffb51c45d67f2e0c71e6ee26f5bb76e6d587539dd87d344a4cc72f7df8cd43d38bbcb6d9ac895842f6ce5751846c6bd21d679
- SSDEEP 196608:VUwRWVFXG53NzXLoaLJS5WUew3ZIZ4TI0C6tJHekll:Vmk3NrLoU0n36Z4dV+kll
- TLSH
  T16D8633C23CCA9771D09BD7B5C94264AEBD293FC1BDA24D0E3D8A3A005D326652F76346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2