327ded16f3c130b783cbdbeeb12eb58bfbe0cb7721ff9c399836f646d5ca1ef5

General

Target
327ded16f3c130b783cbdbeeb12eb58bfbe0cb7721ff9c399836f646d5ca1ef5
Size 8.4MB
Sample260801-ahevqsah24
SHA256 327ded16f3c130b783cbdbeeb12eb58bfbe0cb7721ff9c399836f646d5ca1ef5
MD5 a0c04fc09ee74e087d4734a9e58976e9
SHA1 c1a979f81b6e0bb97f751abfc39922cf5663f666
SHA512 53b5b0a82fa09fc885a03e20b6e7b2ede6ebb97b030348203413b46a00190402324a708d653cb7a4acbe57655f64d19478e7b4a81cd05635a3913ddb3dcf91bb
SSDEEP 196608:tY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHs:tY4qjnt3t0mrWDb7
TLSH
T196963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 af18ab5352b19353ae677a3565aca3cd97293dfc0d3023a796d6fd0bdaeef1c5
- MD5 a97e2b942c9b2ed6a2025cb161563f4e
- SHA1 d9949519b95daa1b3bf3d53237012df7d910f16c
- SHA512 f934bdb7b7eb6863c150ba85c5182782c8a7edf69fd4a8892a7f9966ce395887a1f09b39ea6f5d3f072dce81f71eed776d2fd7070bb981ca07ab5f4e0f74de66
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshW:rBjf4vFYmROxLp
- TLSH
  T1E4963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2