b7cf1e4942d1b834c544af16412da1d375b61cc19ab993b8fbe57d484c7d92c7

General

Target
b7cf1e4942d1b834c544af16412da1d375b61cc19ab993b8fbe57d484c7d92c7
Size 8.7MB
Sample260801-exycvaxfma
SHA256 b7cf1e4942d1b834c544af16412da1d375b61cc19ab993b8fbe57d484c7d92c7
MD5 89711d1767bc0dc0440a82c1de08ff4b
SHA1 3ce49137bfde2e120850d841cee2063b6dcc93da
SHA512 17703675ed59476a6c6d5cfb337c2f7b617a8427c21cf213bb29b174a32339797a72fd7a1cc1aee226d13834588388a114465eb1802fb72ab20474b1bff2fa74
SSDEEP 196608:nPl2Vu28YMUlDzUlmAtyn27sKgpn+hc6JET/pYDVyINLHcKPJyRr:Pl2D8TUlYoIJE/p7cqr
TLSH
T15B9633F70FDE8700678CBA44766E7E938D546EE835452F7416CFA2268CF867A8843B41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd007.msi
- Size 8.8MB
- SHA256 d0f043b4335c5b81f8446a70858585e9818dcab26ae2811be66fa3e3a74b8fc3
- MD5 3f01f9f419c4208de0f4c1ae4cea61f5
- SHA1 cec337ee3cddcdc0ad6bcc8a389de71529ff14ef
- SHA512 ebceb3cc8d5e6d4fd44e09c30a9d3f05b8b203ef46690c1c766e2b81b892e2a174e39bb16b82fa3b491e4bbae65998d1cdda51b0bfa106ca125576f048a98d99
- SSDEEP 196608:+/LMNlAH4OysweVpPIBL/BLvZ2von+hkepcBNHCpfyqXH5QNLfEnY:+jMNlA3yNeVcLJA33wNHxfWY
- TLSH
  T10D9633EA3ECA1734D78BCBB05147682FBD283F64BA665D1A37CAB7115EB02251372341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2