2a27a0adcafd6fe75a588f9a66388941c33729e5892dc860157ce0a44339448d

General

Target
2a27a0adcafd6fe75a588f9a66388941c33729e5892dc860157ce0a44339448d
Size 7.5MB
Sample260801-r2743aca67
SHA256 2a27a0adcafd6fe75a588f9a66388941c33729e5892dc860157ce0a44339448d
MD5 7466dc3b41b81d1c687cdcb48702e375
SHA1 134737e465f4d2d2d7f138ef49d0d55ed6c3cb4d
SHA512 a28096e3e78941027502f4cfdbd7321dab2c391d706f7a17f7d95abecdfd7ae898828078fc44c7ec46092e3ed9c4a14c2110f33d51b89efc58d53bbbce126944
SSDEEP 196608:gwxS8M1CKBsk/99ytWz20D3VRbifOCyDGpaJ2/zPOTDCBcA:RS9287Vl3CygaSzICyA
TLSH
T1437633C82A7DAB6F43ED2243C5CF9A5CA1DA0BF124487B2F6285402D7E82957E6501DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd002.msi
- Size 7.6MB
- SHA256 19aa8d030b7170d7cdc8131cee12295932db911ab165efe1a14b1f025daf1031
- MD5 484753fd481ca73348e19d2dc012872e
- SHA1 2b2ed0c0df9fce43a76bb953f7c3160d5223c7e2
- SHA512 cb201d7a9bba31650c366215c6df7d0f566914459eea43470bb2bc7ee189ff316de5495914476787a6187e1cd6d0fee89fdfc826853aea1414827d851ffdf285
- SSDEEP 196608:cFqgCtak54oVmTP84zCRaOstmrWjUVvRehtsr6O:o6CP8AtOsOWMvksGO
- TLSH
  T1A98633C978DE2B71C0ABC3718947216D716A3FC17E61AD0F77C936083E7265668B138A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2