74b442e8c295c6bdef867c3986d4c815ef013a436c58284e55170f5d36060499

General

Target
74b442e8c295c6bdef867c3986d4c815ef013a436c58284e55170f5d36060499
Size 8.4MB
Sample260801-cm1n4sca85
SHA256 74b442e8c295c6bdef867c3986d4c815ef013a436c58284e55170f5d36060499
MD5 7a2bb6271802475cd40a99743eb7f1ab
SHA1 e9bff47729fa6c24c6664828bbfa2eaae239b6ee
SHA512 0ace1702f0fdb592577a88f78cd0be6db79c5d70e45e1e2926f3d12b8c3c6b34f40e7503ed1bb4db0502961fc8157b11646645199c44883135e09b448016dfd5
SSDEEP 196608:0Y45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHp:0Y4qjnt3t0mrWDb6
TLSH
T1BD963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 4fe6ecb176b3bd65e6aab45e9cec656516302ab5f3444a0210b7856eadda64ce
- MD5 9b4b2b162465846382ae52e02069493f
- SHA1 bc462253068cf24ea0a16dba186e4a0987d00369
- SHA512 6d394e95b7135cd5d5619a4146cf99a9df43c4ce882a156474e4f5a0f378baca6fc4f186605ccff13c11f5862e151fc5b29a4ca8a6b44547d94680e060dd734f
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZsh2:rBjf4vFYmROxLF
- TLSH
  T13E963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2