ffb385dfa64b2411235b31d84f10f8bee86f32e6509d62d409a97a781f93149f

General

Target
ffb385dfa64b2411235b31d84f10f8bee86f32e6509d62d409a97a781f93149f
Size 8.7MB
Sample260801-ewty2axfkc
SHA256 ffb385dfa64b2411235b31d84f10f8bee86f32e6509d62d409a97a781f93149f
MD5 ee713216a6e72285440e169c618d4fd9
SHA1 a17c25dc23b21251971533dcdb03240b67feeb06
SHA512 ad7ad2c91b82b4287f95e956c458964cb44664120fb9711805c7931a08b32b50f9403e685125f87f3b6ad00edef06405d99cc981225bf7374c4065568b5e60b4
SSDEEP 196608:wPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyRI:Al2D8TUlYoIJE/p7cqI
TLSH
T1DC9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 ea5a02e2e43bdbe9511b7c7b392e76168e9447003a2e4e1d396502907fbdbe02
- MD5 6ff4d42c857f23285cf0f941907c5579
- SHA1 4f579e74d5b1528759c4667b61eeae866047ea64
- SHA512 3cfde62a547ab3fda3451917d3de2ed677ca0082815c6656d6e61ea830e72818cbed2ddcf5c729f0a16cb4fa7b97d9ae8418975214da9fd5ea595cf4069e3ccf
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEnt:+jMNlA3yNeVcLJA33wNHxfWt
- TLSH
  T1A09633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2