34762d5ad0ae74da19a511afccbac0857d3e9abc6453c84de5fc61ce2623f836

General

Target
34762d5ad0ae74da19a511afccbac0857d3e9abc6453c84de5fc61ce2623f836
Size 8.7MB
Sample260801-essa2adr2t
SHA256 34762d5ad0ae74da19a511afccbac0857d3e9abc6453c84de5fc61ce2623f836
MD5 e1e3525ee3246018666b03b1923e2562
SHA1 92d36420b84de46fa7735fa60c3efeba59a734b3
SHA512 f13734a72f72f85e5781ece7fc62394782711025c906b0492765089d4bcb1b21fc5bf9abe686f83122b139abbf3420f848b98b46ef40ea4f29e4be4422636287
SSDEEP 196608:FPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyR8:5l2D8TUlYoIJE/p7cq8
TLSH
T1669633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 bf81da9fafdf9e6e5db854d4ec1dfe220672abb330aa384d827d5df53bdd0d63
- MD5 466e0921d0b4921857bfee592fe03012
- SHA1 07c381caab678d2ae93019ea003c4ed0ff96c1ae
- SHA512 843919d70be66d35950bfe8f107691844cb77178ac811be0be8d43b6a831122e406f5976d5e0ba6bfef5cf69ca81bd980d770faf104c1ea4e72d79aafd681a32
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEnl:+jMNlA3yNeVcLJA33wNHxfWl
- TLSH
  T1AC9633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2