3b417d1b040d1f63cba2a419950711be54c1ce376f611a304760e55577c342c0

General

Target
3b417d1b040d1f63cba2a419950711be54c1ce376f611a304760e55577c342c0
Size 8.4MB
Sample260731-z2b1magg78
SHA256 3b417d1b040d1f63cba2a419950711be54c1ce376f611a304760e55577c342c0
MD5 acb0c391b2e90fdc07cc70f3a0e45e22
SHA1 4c9afcea396dac0c079e0b2ff53aca3832be3e6c
SHA512 de439b603794108094c0330bce0d9d731692c1ff31becb3fb0ec4135a458bc8156a92d15086f6f842d42bd0bb34565fc25ef81843480d44140ece1786b521441
SSDEEP 196608:IY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHT:IY4qjnt3t0mrWDbA
TLSH
T154963365E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 fd22dbba61e63385e9388070f7562ebf10cada4ceb06631103c7a28823ed4a92
- MD5 6505b68c55278a28e0e59adb20f9c9c9
- SHA1 b2e050d834fcb92b94bf2a3d12fd6622a6d49afe
- SHA512 05d13ae1ebf708c58e5759d753f315aae4c2712d1d8dd5c605ba9b9896ccdad1bcd36ef28c4b42847b3c466ffbbb9e02a60460bd7d723e5edd52e694d408cbeb
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshL:rBjf4vFYmROxLc
- TLSH
  T13A963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2