056c7267c48ca1ac57bc917afa29e4ad4a33b8d5fb93636e71e6fb691befdeec

General

Target
056c7267c48ca1ac57bc917afa29e4ad4a33b8d5fb93636e71e6fb691befdeec
Size 8.7MB
Sample260801-evhjlsde53
SHA256 056c7267c48ca1ac57bc917afa29e4ad4a33b8d5fb93636e71e6fb691befdeec
MD5 667804dec744e398baa8913986473d69
SHA1 c62b0927f7444ed59a4aafc55f50d2c6bd831de2
SHA512 c0d2f0d7bc39c134159f5933fef0c3148376d56600f5d232380681c6e80d7714c106d1252bc2c1e5526618e213f0501164f671291ef576913a4ab4e35a30ee3d
SSDEEP 196608:0Pl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyRQ:sl2D8TUlYoIJE/p7cqQ
TLSH
T16C9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 d644705490747ec7ffb7ea648969eb32efe24e6f0d2684e43f1cdb9485686ed5
- MD5 bb98120dbefb716b4cbadbf3ba57b48e
- SHA1 ebb7614c7e3db4b9eadd9bb00b960672cd30953f
- SHA512 a51c7f834c0e68bba698a3081e3877283f7f08875affd4f4c7aed36eed5f3e135fb9f80d2882f7c615cc94f9a17482b84c912539917baea1c079a500a4a5b85c
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEnY:+jMNlA3yNeVcLJA33wNHxfWY
- TLSH
  T1CA9633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2