62e348d4d96ef88d306fa82cf4c98552ef4aa12f13ede0b8c5e1939f360aab37

General

Target
62e348d4d96ef88d306fa82cf4c98552ef4aa12f13ede0b8c5e1939f360aab37
Size 5.4MB
Sample260801-jdgcfafe63
SHA256 62e348d4d96ef88d306fa82cf4c98552ef4aa12f13ede0b8c5e1939f360aab37
MD5 6a8ccaaa094ab5d6af40eaebee62b3cd
SHA1 2350d655a9ce2d2bcd340dce0f5b855908a0d2f1
SHA512 7408e62e0f50414d372dcd2401a09e57c59f278c7391b91293e75c4d3622affdc7311fd67b509cd86d1e2bd3bad7fa3ba4814150f8804880d1f08a3296b2cc11
SSDEEP 98304:ZZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1r:SyBOALr5ZXSDAmZ+0r
TLSH
T1F946331AA9D7FD26DC43FDA471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 57f1e17567fa34bdc74fbaea5e6fc2331dea66a1edb5e856ea8d384bafc36456
- MD5 bab5ec6a547dc1e66b57aea332ec4a07
- SHA1 57b93574807a73ab91785536c248bd722bd1f546
- SHA512 4f8d6b00351ebfdcdb3c380988a9c7b5470a37665a2ae19252efa91c15f256cdaa7a2d144282339ca44594ac6c48424531457f4eda2f55e444110491f09b14e8
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8fV:z8H6F1MJhTZ3Qe8i2XkghA4V6YV
- TLSH
  T1D95633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2