8d87898aaf588965d70de502d9cbd162ceb61271f2e9039cb5703d678d8b5052

General

Target
8d87898aaf588965d70de502d9cbd162ceb61271f2e9039cb5703d678d8b5052
Size 9.8MB
Sample260801-mnpcksxyet
SHA256 8d87898aaf588965d70de502d9cbd162ceb61271f2e9039cb5703d678d8b5052
MD5 695db6dd37613dfca555a6fd20369e77
SHA1 f5b78c86d60a9942f996653fbb62e92043ef19a7
SHA512 6a01703f02baf410374fd7ac9c2b46e5f5400348a34b1661bae24b98dfaed39d0058126846a2d5092a62aa0624f6c4f0bad6439901f5e0ba785972c345e83ade
SSDEEP 196608:HAMdoHmXodTeX8uTSEtEjNMhi7UCxKagPj6qZQNmWa5x1UzubhyMjgLJ1Lowfcye:HAMdoaodSPSEKNMhiQCxKagPj6qZQN1Y
TLSH
T16DA633F7479EA9C7F54FBE3A65030A1BF6093C5E12B5F1A1811BC904E8614B11CF6AB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd020.msi
- Size 10.0MB
- SHA256 329c6b9f93a13f53c6221cb296fb9691bebd956e409d14fd99a0d45ec9f7565b
- MD5 fd6fc58a9bbe4d01c8793476f2b3a91e
- SHA1 04e0acc5d508a08fe97bb7e2c183892a6058a2ec
- SHA512 a4474e474b54b045df842c5df0a4fe032e7da2516891a301395a459658df5c2466478fd8685e74eac2d81e6b66c107036166da229cae1391602bebe1aeb480a4
- SSDEEP 196608:HodsbqVMR98Ntf2e45wp8Mdga8PN6kfQLYW2RlPq10NHCYjWbDyWkfqCdLBQv:HodsmMR6NV2e45wKMdga8PN6kfQLr2Ry
- TLSH
  T1F6B633E669CA36B1E08FC7759243262E702C3FD97E758D02779EB6006D7123918F6398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2