e3c4650ff39926a8b088d326567bdec36ba23873a8504afe194f9b296328082d

General

Target
e3c4650ff39926a8b088d326567bdec36ba23873a8504afe194f9b296328082d
Size 8.7MB
Sample260801-ew7j5axflb
SHA256 e3c4650ff39926a8b088d326567bdec36ba23873a8504afe194f9b296328082d
MD5 d40d85e37a70d66b99ff9c0de865af16
SHA1 c3529d8d5b252e154144cf83b10a1f5862139505
SHA512 304245198d2835022dbd54f8d4db9163bcd2c118394b1999ee43d48be6a8c749604435adb31a054f3600c3b1d2cf347649b11047524e4fccfa72994c52d74643
SSDEEP 196608:FPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyRA:5l2D8TUlYoIJE/p7cqA
TLSH
T19D9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 a208430d72bf3a1080baf75b6f41cb67056133dfb5fd1c46151fa618cdb8dfdd
- MD5 3d5534710b32e1a859b9864940894c84
- SHA1 b15c4ed50338d009a19969f84fb47f95004c933d
- SHA512 ec956d6f8916464255923fb7c618660194f931b38cd9354c0c0a49e634dc81f746851930c70909416ae5e68296ed180f3bb7c0ff326bad7972e2458daccee1b7
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEn9:+jMNlA3yNeVcLJA33wNHxfW9
- TLSH
  T1CE9633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2