3e506c0fe26ac2b7f52950127e31f382c1788dbf00dfbfe5602d0abad4b9d964

General

Target
3e506c0fe26ac2b7f52950127e31f382c1788dbf00dfbfe5602d0abad4b9d964
Size 8.4MB
Sample260801-ahdyfaag99
SHA256 3e506c0fe26ac2b7f52950127e31f382c1788dbf00dfbfe5602d0abad4b9d964
MD5 7468991169785b67377641c3c0bdedf8
SHA1 d387cfd9b598ce34b55ee5d76c0b303f31a701e6
SHA512 3843df5de6606d86f94b6951bffe7ff8fdf6a0c4bb2ca3faf3c2f949d01e457b3de39cc1689b4b64d5c2cc2fc7e61fb5de8c6f5a2ac1ad33de146a23bacfd1ee
SSDEEP 196608:0Y45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHV:0Y4qjnt3t0mrWDbC
TLSH
T1AD963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 de99d21f572d4982a663a2376fbc485eb5c1b3b339b7a4f6b2e2c72bb6722cd6
- MD5 ce05bc7ca7ea28818a904320b32b7226
- SHA1 2e0943ac734f204eaaaffe9baca1d2fa9b4dded9
- SHA512 7229ebcc37a022bbe01aeee6c5801000e9d972601cf2267440b4b941c6178ae198a67dc55a6fa6e9d26285c415cb8f736a60833bfbdfc8f6e0b044618b7659e9
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshY:rBjf4vFYmROxLn
- TLSH
  T159963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2