68116083f2d2b32fd8ed8d49baa4b61015b034e69530a298245606fd03e23724

General

Target
68116083f2d2b32fd8ed8d49baa4b61015b034e69530a298245606fd03e23724
Size 9.6MB
Sample260801-e17qpadf39
SHA256 68116083f2d2b32fd8ed8d49baa4b61015b034e69530a298245606fd03e23724
MD5 89eff7576847d2f33959919791b80ef7
SHA1 0c825511352408a2fc06d929d5e504f11193f271
SHA512 4dd085dd3d3ccecdd982ec5ee1f9d95c5822be087ebbf3196ed19627b2a4feef36e60e2c514a19223d6026cdea3fce588f708dcae0a6f8083bf37e3abd97cc6d
SSDEEP 196608:gjwuq4/BqnHUps4iYJdmDEHHLnFWJhCVlwSlf:g8YMnHKbiwdmDEnLshoK+f
TLSH
T10BA63397D9B1A0B17E5CBE473D08166BB780BF68935612E8D8E3010CC596BC978F126F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd006.msi
- Size 9.8MB
- SHA256 41e40014f0e8c5dd14138d9273a22931306c4ced727c86d7547386a8b4741b40
- MD5 8b3aa22bfae435ea8dac73c95379cc4a
- SHA1 d126b9522d580825bba343d0d84a4e16d30086d8
- SHA512 66ad30562fd3512a758f697e6176a34573371b27ab7c27354a8da70bf4c461a1a1a11948a800898a4245eb07d537ef5d51a6ca426be738cc924ecc0b7153976f
- SSDEEP 196608:aGQsDfgyXWpMBjrDVgm2VrS9Ax75hbkJBOfWoEiB:xDLimyrS9Ax5aBGIU
- TLSH
  T1F0A63386F8D563B0D08FD7B32501223FB2187FD5AB624E5978EA360C9D72B5524F234A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2