1382daec33f962dc3c9444af76fb3adbb3f3f5d77f1cf097c9902888cf319b87

General

Target
1382daec33f962dc3c9444af76fb3adbb3f3f5d77f1cf097c9902888cf319b87
Size 8.4MB
Sample260801-aksvdaterb
SHA256 1382daec33f962dc3c9444af76fb3adbb3f3f5d77f1cf097c9902888cf319b87
MD5 ddbcf7bf7260fee5955a03894737efd6
SHA1 1f48b5c3ff38a00f7a48cb8ad1220204428797d7
SHA512 0038ac12ede2f498dfaa4fa83839935952de3ba920ad4b60940b2ee12631f2487d72c5272f0273152e207f67098961a1cfe94bfcddae15c531c78311c4eb3b4f
SSDEEP 196608:bY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHz:bY4qjnt3t0mrWDbk
TLSH
T13F963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 b6cbbc69ccebf3d9399b9f6e2e30b60e6915d5d54246beb2ca9225988071b523
- MD5 8fa5894529d1b00134a93cc95bcb9bce
- SHA1 7d1525518fae3231ee9680f0ec344c0e8422b5b6
- SHA512 4df277486a47a9867b8ab53ce9b38759f3fa3936a9dca5b55c04b0f8159a3de9aa528365119f2b6d4c92192949060e7b71f898df1b265749b252e2907ddda461
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZsh+:rBjf4vFYmROxLB
- TLSH
  T198963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2