04ab5dc4424e5456874afaaf8763c4bfc979bb86ff51c543aad3656f3b789882

General

Target
04ab5dc4424e5456874afaaf8763c4bfc979bb86ff51c543aad3656f3b789882
Size 6.0MB
Sample260801-pgvbcsvcje
SHA256 04ab5dc4424e5456874afaaf8763c4bfc979bb86ff51c543aad3656f3b789882
MD5 17e6a60daeeeb0c8ecabc99766f9fc3e
SHA1 2467df07261327c09fdaf911275a424d8ea0d24d
SHA512 957e2ed54031d824679d29ebe90bc9b6c2331fd199cfca330493bb50b62464db24e318d221e42afe2bfdd10379d825c7560a48a1ab434d2fc3d329fdafef1930
SSDEEP 98304:kAwpuuq5P8KQdoM/ZU4Lei/LC8PgqgnvwO5Z3apXIcUxnvc8rpCZDO+tVSsBaTEZ:bwc5P8xdgDi280nvp5Z3apXVBVdBa3zw
TLSH
T1685633D63651D5866CC338E23ADBCD08757A0A58F496D27EBCAE58F55AC3F833C80885
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd018.msi
- Size 6.2MB
- SHA256 7235318625fbfe88e5882d54d6b2b29d62e175ebda7389111fddd187aae55bbf
- MD5 2e2d10093dfc3703ea2e87515e7fed06
- SHA1 179af40a65f6cd1a65120daafb542e12522a5a83
- SHA512 bf66135ddebb894c2d888ece50735f48b40284cf9d22b18e10c7d0cd7ba9665885091b7ebf7f9314d95e01fb4b1d0ce8a5aa9b9fef50e0a3009a2a8dd9b7af65
- SSDEEP 196608:HJrMk1jQb8WotBWNaBVZnlZrdNzfXQBnS:HJrM7Cdnl/NzfAlS
- TLSH
  T1CF5633D23CC52771D497C7B24086A62CB27A3FC5BE669C167BED36145E73B1228B2348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2