0128eb5c497ec624c0685ce7eedb24775d74a922a84d71bf16efa7d4cb260c0c

General

Target
0128eb5c497ec624c0685ce7eedb24775d74a922a84d71bf16efa7d4cb260c0c
Size 7.5MB
Sample260801-kf42ys1fkb
SHA256 0128eb5c497ec624c0685ce7eedb24775d74a922a84d71bf16efa7d4cb260c0c
MD5 761b9a384f93e04f4188059e5f2d9c44
SHA1 f8af4123ab417942ae66dd2bca43c47cac480327
SHA512 8d2b321c09b3166145fd5a0a0ddcc22976557d1f148b87f36c7169caf9cbc6b2306220819ca3f7baabea876fbbc44b4e3e804f941f22fdebfb85e33955c4f66d
SSDEEP 98304:f4urb15YLJaRMsR51je1raI6+iuQ4M2uAVJFQehCJRoVe8pz5LtjpI8UAHQTsD97:f40bDRpWrdDQxEVJhCJR0vjVhkNkV
TLSH
T16C8633A764533A26FF7F6D7AF630739E0270185F48EF8B1F2092329671D4616B248D62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd014.msi
- Size 7.7MB
- SHA256 0964a636321ffeb7975a0170446e2e2c8fc5a380c77066be5836f268066f796a
- MD5 c36f7496ac372b8dc5ccf97c70210ef4
- SHA1 7d448113ee7e78b624a54116b6d33586f5ae6e53
- SHA512 70f1bc7e63c4bb47f9afbc747a76f7f71f4a62f8858c060280b4e6d66c6351600c22ae05792eb7d9201cb728ce3b73f5c08c971db415ed9fb55d3b77963e6f5a
- SSDEEP 98304:IuQ3X5Yt1g1MMtbzFqprAm2A8Gy49G9ZQrd/eJEl8cCVd4XKEp7vbrnbMuWi7Q7o:Ip3D1R6rF5y49kQR/HlCVdIjbbv6tqP
- TLSH
  T10C8633C17C822B71E55BC7B4A11231AE7D243FDBBABB4F1A77D4364029B1322A276744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2