46cfa4d52208d68c3019a9c4f39f599ce5eefe66efaa6b3694c520532ee38cb3

General

Target
46cfa4d52208d68c3019a9c4f39f599ce5eefe66efaa6b3694c520532ee38cb3
Size 8.4MB
Sample260801-cpw4psca95
SHA256 46cfa4d52208d68c3019a9c4f39f599ce5eefe66efaa6b3694c520532ee38cb3
MD5 6478536e2e63e5299b03dfa9aa558639
SHA1 0360fef915120239c6ddef9652a9b82619c7d775
SHA512 f7265b953dc18d54be2f86b3bb44a024db9214abcd1fa1eff192e1dab01c138549a077ec565ed9eb21dea2c9c177bb1a1731d20b1916c61152e6617485e2f5a5
SSDEEP 196608:7Y45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHr:7Y4qjnt3t0mrWDbo
TLSH
T129963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 8652472d95161775b1a689989775590cd87896717c111d0f5e9dc6e841d438b8
- MD5 1714f8b1ee6d815f5d445f33c9cb9a6b
- SHA1 927d1028393141ccc9b929fd159d1da202aa19b7
- SHA512 be8980f558a9a5ca540b6b0cf6cdfac5f75a9d1ca46132b12ecec68c5ab71b0eb591c56dd893419a01e8142e4391c7243ce55c18bcf9e6bc72fafd32c7ec8b23
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshT:rBjf4vFYmROxLg
- TLSH
  T1DC963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2