a539e72bc02860529c93d7a0b2db5b588aa0f0dc1622c9bb31deedc85fdd5eff

General

Target
a539e72bc02860529c93d7a0b2db5b588aa0f0dc1622c9bb31deedc85fdd5eff
Size 5.4MB
Sample260801-jg2sjs1bng
SHA256 a539e72bc02860529c93d7a0b2db5b588aa0f0dc1622c9bb31deedc85fdd5eff
MD5 8183e613b07a36efecabd967ec09c473
SHA1 1d5bb5c7f8bd635437d0a31e0207b5d482465eb1
SHA512 690443a28d9dc2bf0075005265af5a2e6845fe5dbc137e1aaeb881a206d7459e1a7282044eba964c900df46d3340d18d94a7b8cb3e7ffa897037a0d5477af1d9
SSDEEP 98304:xZmyvZOALr5Zjs+/g+4UL6IveAm2v7mezTC1o:KyBOALr5ZXSDAmZ+0o
TLSH
T18C46331AA9D7FD26DC43FDA471239F59E262EA4102B5E4ECCD926C59DFC201023D1B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd012.msi
- Size 5.6MB
- SHA256 895c79cd4b9def12b646dcc6a9c2bdfed4ec81a96777bbc9daeb87c26c7ba019
- MD5 2a4c005299cd2ed6268c58245570d119
- SHA1 a0f51895177f60c79497079f4f4a1473e06ec3c3
- SHA512 bebeed835410b88503fbed97156917c2f056912a734e2f7d0fd25b4013cb1931d0b0361eff6424a38de515e4adb938b28134b66b0464ab4a3a1bf67d48c7b61f
- SSDEEP 98304:z8HsdYyFfMJhTZXuybsfe8i2pdkwdDXPhA4299ueFT8fK:z8H6F1MJhTZ3Qe8i2XkghA4V6YK
- TLSH
  T1C65633D9BDCAA775C08BDBB01103A66DB12DBFC17E72CC2A7AE539004EB351466B2744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2