1c015271e96acecb83d6d7e844fb47e270d25e1e9b3b24e9ca10cf7c3494a135

General

Target
1c015271e96acecb83d6d7e844fb47e270d25e1e9b3b24e9ca10cf7c3494a135
Size 6.0MB
Sample260731-rh17eavarf
SHA256 1c015271e96acecb83d6d7e844fb47e270d25e1e9b3b24e9ca10cf7c3494a135
MD5 128f827d682e37cf78bd2e8466286ba9
SHA1 baced4684b407372b7df231377d91d7fe82cbc37
SHA512 3f9480ae66771a8240665c1ccab210f408af0c174b1560d40b830174eab3eb0f3bf8b9f9cafe8af08dabffe08c0951ec0c9d68e0208df684c51d5eb2dbd65244
SSDEEP 98304:pAwpuuq5P8KQdoM/ZU4Lei/LC8PgqgnvwO5Z3apXIcUxnvc8rpCZDO+tVSsBaTEK:6wc5P8xdgDi280nvp5Z3apXVBVdBa3zX
TLSH
T1CD5633D63651D5866CC338E23ADBCD08757A0A58F496D27EBCAE58F55AC3F833C80885
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd018.msi
- Size 6.2MB
- SHA256 e6e37715646ebbdeec4a002632f714fbfbd3e3cdd4d2309799c9d9901ae1a09f
- MD5 c5880b8aaaaf0c67becfdd03b195dfeb
- SHA1 dbb47389aaf412b2a91d716cbcba43042c43c63d
- SHA512 bc77277b060b4d07d8a703a7181e03bec8dffc3954b8e6a0bae454389e25f45515fbeba20e8be8941a10f84528c3840c88c70223fb118c6412d0347b05908d8f
- SSDEEP 196608:HJrMk1jQb8WotBWNaBVZnlZrdNzfXQBn6:HJrM7Cdnl/NzfAl6
- TLSH
  T1545633D23CC52771D497C7B24086A62CB27A3FC5BE669C167BED36145E73B1228B2348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2