ef45be6c7975c8314539d327193ab36c62afd0d61cf18ba6d3a97e90416f10db

General

Target
ef45be6c7975c8314539d327193ab36c62afd0d61cf18ba6d3a97e90416f10db
Size 8.4MB
Sample260801-bkrgzsbd36
SHA256 ef45be6c7975c8314539d327193ab36c62afd0d61cf18ba6d3a97e90416f10db
MD5 72c2862fc399cc8219659c6a5ec241fd
SHA1 461012d05788abb14a7d70c4557a13ed445ce8a7
SHA512 25f09c07eeee9e9ec88d35f61295d3e9cedffb2dacad95024ef1aff9637bf389e1407608152f3e81f9074bc2278da6c84ec7b41b08f9071df639765a4fc10805
SSDEEP 196608:JY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHt:JY4qjnt3t0mrWDbS
TLSH
T1C5963366E0E7CF9B059898DC07611A1ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 a8e9e4d8194fb50a70aec7542fdf88cc1bca35a4f6ffdfbb1e12af97df0f1b5c
- MD5 1286984568132687b994d92c294e5599
- SHA1 0139676e6a054e0cba170fe509b598faeb388efe
- SHA512 bd2e1169dd10397e04027fc6533f0de7bfd0ea2b81d5fe56ab940c50be78d16a6188bb73f4717723a1798c2bddc707d08688a2897de98db09081256db6623aa2
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZsh+:rBjf4vFYmROxLN
- TLSH
  T1A3963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2