9b32059547e13046c19df47e56bb85c1fa7194d616a68deba9397cd3f3c1f87a

General

Target
9b32059547e13046c19df47e56bb85c1fa7194d616a68deba9397cd3f3c1f87a
Size 8.4MB
Sample260801-bmhb4ack61
SHA256 9b32059547e13046c19df47e56bb85c1fa7194d616a68deba9397cd3f3c1f87a
MD5 75cf0abe21acbf82d31f0711359c295d
SHA1 093480223d1de520905bd7729fc4bfa7ff3df6bc
SHA512 91f750a9d4b49b020dcd6f0e455168117931b3511054eb0969079e3e13b277632ac79d791490e5e4631aae6f628aef6c4df3b12365a098bceba722d79eb5c041
SSDEEP 196608:gY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHc:gY4qjnt3t0mrWDbz
TLSH
T10B963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 647233b546cdf9d310e7cf5893171f2aa983a2ed28c64f1a3830bd2f1bb9df34
- MD5 ffbcc8ba6b792ddf815c1d3fb3572309
- SHA1 00d8f7e4ed661c5fde0a59e1abdc9405b94c988e
- SHA512 5944e5c82b2885ecc545db991f6d3a483aca8690f4903f2cf9d1e6d51bccb92b580e2666716eb351eedab75a27e7f0a93d8b7bc790ebc58f269488c10a28af27
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshJ:rBjf4vFYmROxL2
- TLSH
  T1C3963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2