698781b82aed704c7c92781b8ac5a6e668dea14a714d63e9dfa2522a629d7a71

General

Target
698781b82aed704c7c92781b8ac5a6e668dea14a714d63e9dfa2522a629d7a71
Size 8.4MB
Sample260731-z4qlssssft
SHA256 698781b82aed704c7c92781b8ac5a6e668dea14a714d63e9dfa2522a629d7a71
MD5 5898a94fb523537c3f2b71529d4a3446
SHA1 c7ab619e0207f4f9c806b9f7a5e165207ba7417b
SHA512 5f578f4c4c0c75a30919013123ef26267eabd1ad3d3182676d9c4d1d02c66be2d97367203e68b0229ff9f7a43911256d1d5c724f828da1917f197f8ed9e70dca
SSDEEP 196608:GY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHp:GY4qjnt3t0mrWDbm
TLSH
T1A4963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 b70ad4f68a3cce8feac3a6e2fdec90e894de9adb520dec768f441cadeb04e35b
- MD5 2a688c5a570e265728190f0669ef451e
- SHA1 696cfcbf0fdeda84e91c4dde1311867d8ceda29e
- SHA512 7ca9d84ef5e33adcdda11ebf53ffd3b7a1e4de0d1afb5fc120ba06807440fe6470ccd938513a275d5d69dacfb221880a35ce9972fa1d7deaea0092ab9bddc2fb
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshO:rBjf4vFYmROxLZ
- TLSH
  T1A9963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2