4bd496a566022fe3433386e462e776d1eef4fdcff15b5352080933bb79c24d4d

General

Target
4bd496a566022fe3433386e462e776d1eef4fdcff15b5352080933bb79c24d4d
Size 8.4MB
Sample260801-cqeaaacb29
SHA256 4bd496a566022fe3433386e462e776d1eef4fdcff15b5352080933bb79c24d4d
MD5 af2200889603daefd594512db3168806
SHA1 3d209180f6fabc766c8b4d059498cf5deb818a69
SHA512 2ac3939071258e09ac7d658733cd381aba1f805eb535d83b12d3645bf918fcf4ae7582654b261fa461829e09c45d2c7a72db4f75b3fc72270571b39cbe4227f0
SSDEEP 196608:UY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHZ:UY4qjnt3t0mrWDbm
TLSH
T180963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 698a41f3bc1e8b4289471ef765cd5cd10038d48f7a241fbcd3f43b3bcab14c10
- MD5 707351f4dc705394f067345d3e50dfce
- SHA1 fa319cb951bbd7aac047dc181983a33424b1d094
- SHA512 c224f317eab21f8871d17d96bc1d62d5217381587787dc3d23982ec4098e25ac2f7d8b817a35a48b6d4f1da94276e639763fe2807bdc53da41789b5e5cf42266
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZsh4:rBjf4vFYmROxLL
- TLSH
  T1B4963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2