8583b4a449f4f680ddbf891c97adad86bdb954ca10a297af56280876cb43aa88

General

Target
8583b4a449f4f680ddbf891c97adad86bdb954ca10a297af56280876cb43aa88
Size 7.6MB
Sample260801-mfsp2aserh
SHA256 8583b4a449f4f680ddbf891c97adad86bdb954ca10a297af56280876cb43aa88
MD5 d4797673bd137fddbe438806ab337966
SHA1 33f026cf5187072c12243a8c41b080c2abdcf451
SHA512 41b3d78374d0ea214a91b41024243afcff8ae53c699eb6e8bc5615a30b7024e17e5cc4910e1c51338bfadb9b73b09f8ef52a51c457eae520ec195865a7cd7bbc
SSDEEP 196608:WCzeUmVXJaHB3T9TgmQ3k2hWUw2bBSH8pgCgSzdNOgnX:WCaT2B3ZTg5vzboH8j1mgnX
TLSH
T1E18633C0BD8B95BA75CDB347DF60900BF62100E12CC569EE644F378498669FA3FAA1D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd015.msi
- Size 7.8MB
- SHA256 300bdf39bdb964dd989046a6363a932b7bee1d0e9d565249110d30c2346187f3
- MD5 b52c140c13f6a9ebd26fae85a4d575d1
- SHA1 c5657e20966158cf4b0e4b5b31564cd995b4297a
- SHA512 2adb9607c5bf8eedb0f55e3e8f8905f2431ad621c8e78de82c7157cb94b10dc6f34b819a3bb3fed9dce740c507b9fd525a8fd301c3591b3166b91aaac5ee769f
- SSDEEP 196608:VUwRWVFXG53NzXLoaLJS5WUew3ZIZ4TI0C6tJHeklh:Vmk3NrLoU0n36Z4dV+klh
- TLSH
  T1028633C23CCA9771D09BD7B5C94264AEBD293FC1BDA24D0E3D8A3A005D326652F76346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2