de119729c9252e851c75204ef01a62e5d85302df691fcdb0eb4b4f72ebd3af84

General

Target
de119729c9252e851c75204ef01a62e5d85302df691fcdb0eb4b4f72ebd3af84
Size 9.8MB
Sample260731-tnr7ssdb92
SHA256 de119729c9252e851c75204ef01a62e5d85302df691fcdb0eb4b4f72ebd3af84
MD5 1bc153de0167a385005bc24a7976292b
SHA1 4dcbd0e4f8de3184ad4594486e203029ee5d0301
SHA512 6e69b22eeb4a0d062ae31b0ed1c9fbacb65b835dac1ec1ae2f4e7f251afe340a0a1e7edf9b8cb19383f26c166e59f6a60397b61b474351d7f85dec7621e6eed2
SSDEEP 196608:1AMdoHmXodTeX8uTSEtEjNMhi7UCxKagPj6qZQNmWa5x1UzubhyMjgLJ1Lowfcyg:1AMdoaodSPSEKNMhiQCxKagPj6qZQN1e
TLSH
T1CAA633F7479EA9C7F54FBE3A65030A1BF6093C5E12B5F1A1811BC904E8614B11CF6AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd020.msi
- Size 10.0MB
- SHA256 47fae90ec5784b735bbf9ac537dc46353cb2ff44fd0124aae1d1bb70a6fd6254
- MD5 0af0859d4c861b9417704ebd069e5ff9
- SHA1 c119ae4e74befd400ba29556f9067e0db6d83bc6
- SHA512 d8c68b50bebf76f2df7fb7ec34cb61ee021f5750c87bc02d4e0fe1e15befe085b492899b33b951dcb76862034a6d7532750bf77cb6f20825bfc1e9b30b691e5f
- SSDEEP 196608:HodsbqVMR98Ntf2e45wp8Mdga8PN6kfQLYW2RlPq10NHCYjWbDyWkfqCdLBQ4:HodsmMR6NV2e45wKMdga8PN6kfQLr2Rl
- TLSH
  T1ADB633E669CA36B1E08FC7759243262E702C3FD97E758D02779EB6006D7123918F6398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2