3573cd6cb58cbc795a3339474b7068c0b1199ab2d4721d3a8bef4397013a94bf

General

Target
3573cd6cb58cbc795a3339474b7068c0b1199ab2d4721d3a8bef4397013a94bf
Size 8.4MB
Sample260801-cqe7kscb34
SHA256 3573cd6cb58cbc795a3339474b7068c0b1199ab2d4721d3a8bef4397013a94bf
MD5 400c9c3957bf4f6250c9043311f2fa67
SHA1 c5566dcc2b694d4d9ef355ee9035c4d1eeac2f16
SHA512 e8187e7c345d6f81c6cf6b24ec29be56116b38cf804117b05e5864da2a7e1f217b9d1bdf5618aed7ba7ea4096fe6e2c29f84ee5ab86f944f01aa25bf326f8201
SSDEEP 196608:AY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHt:AY4qjnt3t0mrWDbG
TLSH
T173963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 6fbfd017c896b2ba5fdec677e56d30f3b83ae5e577f82964231434ad6e5b7c6f
- MD5 e63889e8b4c24b708e0d2e00c1d92e34
- SHA1 7e7a41929d4a9aec27d0bbbddd2c1f4078523352
- SHA512 0843464c0508b89b214d3abd29132d1160a074276c085710861ff4feb7fe436ef0ddeb19742ff67a041c7a884c52a266a4ebb98451d37eb0257d9582d923721e
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshO:rBjf4vFYmROxL9
- TLSH
  T1DD963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2