914bf91566b1ec7f714976f4f8a8565bdd18f5cc492cb7735ed3e80fe4747004

General

Target
914bf91566b1ec7f714976f4f8a8565bdd18f5cc492cb7735ed3e80fe4747004
Size 8.7MB
Sample260801-espj5svzft
SHA256 914bf91566b1ec7f714976f4f8a8565bdd18f5cc492cb7735ed3e80fe4747004
MD5 103739d7587849e8573fd6dd02e62e57
SHA1 2d6f7c79468dff1bfd6f88039aad866608ca8c42
SHA512 4e288d809130b3946aadcd1722759cf51c1dc4c6a68d44af87e832884c239e0047c862af908c286bb57c7ab2397a93db9b44e3a66c9cbe9a538608a130d86031
SSDEEP 196608:xPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyR8:tl2D8TUlYoIJE/p7cq8
TLSH
T10F9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 daabdc3d7201a64a19a019ed6b0f133a78ffdf6fe9b051fd3221728277881ac1
- MD5 7f45e3dcabb16f5d83a3c8d9ea639b31
- SHA1 858a7f096cc3b7f937e47b6351c0ab6eba86d466
- SHA512 895741c388e8b88504287fec5369f98427d2e6e73353f79b82293d8d3bb41946b75d2970a5d359cd5c53bfdf9be4dd992dad8b548aa9862894830e573ded8e9a
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEno:+jMNlA3yNeVcLJA33wNHxfWo
- TLSH
  T1B89633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2