2a08b8d603036da91d2450320dd1185d4c0081de1094946f0d6682a30ffe78ee

General

Target
2a08b8d603036da91d2450320dd1185d4c0081de1094946f0d6682a30ffe78ee
Size 8.4MB
Sample260801-bkylastzbs
SHA256 2a08b8d603036da91d2450320dd1185d4c0081de1094946f0d6682a30ffe78ee
MD5 8b012befcd8d3053cf9ece2473424484
SHA1 5269395088796775543a7c84f7644865d3aa5c9f
SHA512 16b8ebdbf765a22bf83dc67832049b56e9aacc6de485f1198d64da49ea1e8141525a9a64d2e737295f91decda113c20b74af03295a7226e878737ef28e7b3878
SSDEEP 196608:xY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHU:xY4qjnt3t0mrWDbP
TLSH
T171963365E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 260c7da65166a8940f8d214102ff550f450f884648acaff3be37f39472354a28
- MD5 d1bc29228a77fd7aa779a012c9950436
- SHA1 a7f1c710aba39c9a66b19a14c36acbc7a494fb8d
- SHA512 ae7c94192ad8e5536812d5fa6d100937e0c47be6d84276859c81a524ef3bdd6aa54a65d876ee697107551b1adc61e088e2c7ee7aa341274940239e1d767c19fa
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshp:rBjf4vFYmROxLW
- TLSH
  T1C6963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2