df889d4ad36e793fb5eda09ff3f8b26a5f671334efe4a2e9b19fb9e91a567a2c

General

Target
df889d4ad36e793fb5eda09ff3f8b26a5f671334efe4a2e9b19fb9e91a567a2c
Size 8.4MB
Sample260801-bkpy6abd33
SHA256 df889d4ad36e793fb5eda09ff3f8b26a5f671334efe4a2e9b19fb9e91a567a2c
MD5 2089268aac4e6114eb2cdd122045edd6
SHA1 30a7e2b6c1a927a45d42272d180e795c0f9c0d5f
SHA512 3a73c8ea7c246234fc578019ab4a052633d1d239bd691a9ef67abdf249a47b269d2c60525252b132a7578e399f98b66ff777a42ba48d844181c006065e001c64
SSDEEP 196608:UY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezB:UY4qjnt3t0mrWDbO
TLSH
T1FE963365E0E7CF5B059898DC0B611A1ED83490346D241E873ACFF2AFB5A35E27C277A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 c52f674d5d23a90252930412365aa48cbd4a0ced2bc653cdef60588c733c2e3f
- MD5 5d8a5ffef69d64df0b3cad2f04a7f211
- SHA1 eae8e445ec84f2fd86c1457b24675c4922fb666c
- SHA512 83ece98d4541d1507b2fe36929d7cbb3c7bf838c042833d750121bac1e51200593d63a0ccb49ead267039d4c4ad3399a3fae35bf64551c197f09145c845edd25
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZsho:rBjf4vFYmROxLb
- TLSH
  T192963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2