36d1e92e73cc0b65400f59f7519fee4afeaabd60bc8dc85cfeae60680b8b3073

General

Target
36d1e92e73cc0b65400f59f7519fee4afeaabd60bc8dc85cfeae60680b8b3073
Size 8.4MB
Sample260801-cpxp8sca97
SHA256 36d1e92e73cc0b65400f59f7519fee4afeaabd60bc8dc85cfeae60680b8b3073
MD5 1980067a477f8da5b6a9f3cc833c7cfc
SHA1 cf4a638f347b6ec93f74e2ef41696af8be260449
SHA512 1ea06b6bf84dac3504d99a5f23fb497a0dc4adc029e605a36fe616de8e8f6b571ffd6c451687cfc21dc59b6c365542012ab97b71eccb304512feecd2d037cc41
SSDEEP 196608:mY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLeze:mY4qjnt3t0mrWDbb
TLSH
T1E1963365E0E7CF5B059898DC07611A1ED83490246C291E873ACEF2AFB5A34E27C377A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 9c4d19ba972e6dc5ac922df6694782bbea19c86d8e02b5a65d4821446a1a150e
- MD5 39b65ac7da1f6948124f42baf21b5c5e
- SHA1 012b56840b238d6f38f5d81e3ac5f249de303439
- SHA512 d0050749510ee14d6af5982a92db809d23aa6b7e9731a79f18836e5551bd150c853edaaf1bbd360b7f21e60c4123a212d086d0e2086d203381115a6ab43147b7
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshe:rBjf4vFYmROxLt
- TLSH
  T143963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2