de0519196ddb36822a5d4b0f375f40858d3c1cb8dc354cea0e78c3a2cd9a8160

General

Target
de0519196ddb36822a5d4b0f375f40858d3c1cb8dc354cea0e78c3a2cd9a8160
Size 5.4MB
Sample260801-jaf79sfp2w
SHA256 de0519196ddb36822a5d4b0f375f40858d3c1cb8dc354cea0e78c3a2cd9a8160
MD5 e494c1904a53e1beb3770ece9e53c433
SHA1 a6dd7ae23d35a5ed8968b69ba0d81072f84d1c8b
SHA512 8aa9f7a0960d6fb79c3b428b404d24305d71738ca59dc948843c64b9b04862b376ea200bc729c844e9470a4670879d43a277b4c8a4adcc22c5d1ff811fa9a7e1
SSDEEP 98304:8ZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC19:tyBOALr5ZXSDAmZ+09
TLSH
T14546331AA9D7FD26DC43FDA471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 83130169cfa108348777918dc2c3c96011f265eec959ae67c1de58cf8ec74c2a
- MD5 d3a3252216fba8a182d5c5f912a82d75
- SHA1 9435a26e2816946e54da256160b4396848b02205
- SHA512 0499c89e81cdd2cb69e704783b7c246b27f1aaa8f6abe18ff8a7a65c32f5c9ec5b6506594e77de36548f73ee22ce30c3b060232073afadbdcb85c3b47559f6a6
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8ft:z8H6F1MJhTZ3Qe8i2XkghA4V6Yt
- TLSH
  T1425633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware discovery exploit trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2