fbb683011a8e9c0e59c1ea84b397f235db4052b6d5e4debccdfa38abef503065

General

Target
fbb683011a8e9c0e59c1ea84b397f235db4052b6d5e4debccdfa38abef503065
Size 8.1MB
Sample260731-slb75ace34
SHA256 fbb683011a8e9c0e59c1ea84b397f235db4052b6d5e4debccdfa38abef503065
MD5 17a02e5bca0772b4f3f7b38834a97bf2
SHA1 f3587a686d870a0a7952333cc96779a9f1261d2f
SHA512 431a57210ed76b10dddddc978644c723ce33a3224e24e2f18c29b7d33fa2dd445420e74af6daca5b5908a246efa5c61d6f62f3e651d5c86bafda487d21c09af4
SSDEEP 196608:LXKKztSV/PdjxviDK1Z5dD7xpmsbG40egf:LXKNZ5dvxpmevK
TLSH
T1B486330730F2186A58FF43D90DF36876050C51C7988E75A623F1EA940A9A5B38B9FFE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd017.msi
- Size 8.2MB
- SHA256 d24b37a0f6efa5ec695d4c716fcdf95ea75c49f3add410e5fdaed64478320b12
- MD5 450b7c6969d032df9b49174da0b0e836
- SHA1 e7ffd646005995fc46bc9c8ffbf029ba8478a2d6
- SHA512 f4110913cd9e9bd7ffe75d7db2cc6f37043d2652a65e9eccd67bf9ff10fe61e5f1ea1c4acd17f4ddded1592301381b8aed6744fe99d097a31ff18bf383336fd8
- SSDEEP 98304:w0GvgKqupNxZJRIOYt1tXM2qPi6v+g15ED2WsW9HRmsPpHgPJbmBu3o3xwf+Uc2G:iv0SJ7ontc2i+dyW9xJPPPfCS5G000v
- TLSH
  T1BD963382B9972775C0ABC3F61453316E311C3FC17C6A5C127BF57A181E73A22A9BA784
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2