3469452855e42931ed77c7de86b370ff0b1b65bf9da9134a9ff57228a69f30e0

General

Target
3469452855e42931ed77c7de86b370ff0b1b65bf9da9134a9ff57228a69f30e0
Size 5.4MB
Sample260801-ja2tzafe28
SHA256 3469452855e42931ed77c7de86b370ff0b1b65bf9da9134a9ff57228a69f30e0
MD5 d19b921b2db1e87016a06de98edadfb2
SHA1 aa9070bd3e81881be0c1281d26e2097aa6c2a6a0
SHA512 7d8edd4965ec50b060350d8bfb20ba7ca851e5ed9954e9de97d5bc2731f71fa7ae4798fef1b51b363d276bc873572e5d8e66b2077637c94ff4d6fada470a6f9b
SSDEEP 98304:nZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1g:AyBOALr5ZXSDAmZ+0g
TLSH
T10B46331AA9D7FD26DC43FDA471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 614ad0dbfd85a25b5d90ce98d79797c854b1c96a3a414ccf2bf17e8a70270c50
- MD5 dc1f1c8035d9e7c6d46fc3b4b8543b10
- SHA1 323aa191900ad709127231cb5186047229d6aee9
- SHA512 76f6d5ad7411060ff32059149348a19cc8ee35d1af9af57f470320a7f7306ba48d685441549b03b68ff96b728e7479a566f8c372107dd3afad19861a5aa3c8c1
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8f1:z8H6F1MJhTZ3Qe8i2XkghA4V6Y1
- TLSH
  T1FB5633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2