a97edc93000f9c5da81704b6f15425bd904e5a7199249c0e356f03dafd306474

General

Target
a97edc93000f9c5da81704b6f15425bd904e5a7199249c0e356f03dafd306474
Size 8.7MB
Sample260801-exf4kaxflf
SHA256 a97edc93000f9c5da81704b6f15425bd904e5a7199249c0e356f03dafd306474
MD5 353e5d51452be43c1729d43509533d98
SHA1 95bcefa4a4e8d810d69b0139b4bc2ceb64a17ab6
SHA512 9a0a844915b5488c58b944f0ad6446cf851ea2f35bf3e0087218bf8e245b1b1fda143115ec76a107d0a68597358fa098798b0da00d78835bf003b8037e8efaa9
SSDEEP 196608:jPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyRK:Tl2D8TUlYoIJE/p7cqK
TLSH
T13B9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 591777a1cf4c1a3f5e1287e853aa6a22a745a3a1c356af90ada385c008defe00
- MD5 678759a26c1ed3f5b80aa9d61b2b5c57
- SHA1 a5b2a6d68cd0e67060d3926c5a8379726ce45e96
- SHA512 5cd575995aeaa6c181d61c85f8e62264cc355bb8ccc8abe2927d5703f801ef010e5ed916724891bd7f2a5b26b5c718415b5995b060c3d9ebae35ac681f3c3092
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEnI:+jMNlA3yNeVcLJA33wNHxfWI
- TLSH
  T1FA9633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2