6c56b2c23ee638f9982817bb759f61b63052c05e72df80a108a76a25340017ca

General

Target
6c56b2c23ee638f9982817bb759f61b63052c05e72df80a108a76a25340017ca
Size 8.4MB
Sample260801-cqs4facp8s
SHA256 6c56b2c23ee638f9982817bb759f61b63052c05e72df80a108a76a25340017ca
MD5 9e5fee127bc77e7db39aa8f4f8cad86c
SHA1 2967db6c1591255f159d8017455dbb2464ab617a
SHA512 1fd08dcd54f2e13f923d32b5081d1be2599df84b2b3987456c326c4e9a3626957b310e411d767e7e12a778ab87ffaadb464e2d8e355248afac70da34aaafc574
SSDEEP 196608:CY45isGzj47WUm6a3db0mCa/X+p3/eZsNbVLezHB:CY4qjnt3t0mrWDbe
TLSH
T198963366E0E7CF5B059898DC07611A2ED83490246D251E873ACFF2AF75A34F17C27BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd004.msi
- Size 8.6MB
- SHA256 8def19b3b8e15b803a22379e46a7690db76afa123e7c2dfb4ace8c654f8c697e
- MD5 b54d5e93357b12ebe8d93c951df7ba6e
- SHA1 6d91a40fa0fcb041a93816090fa9aa925f11b094
- SHA512 d814e9ae00190bdc73b9efed8c018e873fa6e1c4c01fc768d6091aecaa7a11e3c2cf6091d68d0427e6648bcdd9d4f60fb4c658ba5b13fe66e020a476ee423a1e
- SSDEEP 196608:r5UgPjavVwl4vlTYmGEhN8R7tw1UfLRZshG:rBjf4vFYmROxL1
- TLSH
  T1E1963386B8C667B6C19FC3B45242282EBC387F917A720D073B9D771769736212B36349
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2