4c06dc660b1477eced5050fdd1775f969ee453161ed62f34255d132e1de7e2f9

General

Target
4c06dc660b1477eced5050fdd1775f969ee453161ed62f34255d132e1de7e2f9
Size 7.5MB
Sample260801-rrfbas1xdy
SHA256 4c06dc660b1477eced5050fdd1775f969ee453161ed62f34255d132e1de7e2f9
MD5 c6bd737d6bf81b9081efe05e17f1da32
SHA1 2b62821cf8e2357b12048906d778d7bfaf568456
SHA512 5dcdc19dc9a312355e05b5bb5575899c08090e2c02df411dccba73322e61f2e0698bd39cd6d662a922b4992136241e5a2a12cf57fefb6e47cee42d7597c629f9
SSDEEP 196608:wwxS8M1CKBsk/99ytWz20D3VRbifOCyDGpaJ2/zPOTDCBcT:hS9287Vl3CygaSzICyT
TLSH
T1997633C82A7DBB6F43ED2243C5CF9A5CA1DA0BF124487B2F6285402D7E82957E6501DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd002.msi
- Size 7.6MB
- SHA256 294983e041efcd48da240d545e42cfc0740a3f9145aae379aba978cc9304bdcd
- MD5 ae87aa7e9cedc1fb92dd78fbbbabba19
- SHA1 6bb5e520a44a257932571a76dadfc661ca335cc6
- SHA512 f4d7ee55b1ee30f563ea60fe4f88c79ccf65bfcf6f1a89fa4fb554cfc1bf8cbf26e605de3526496034ac953373c9a04e2d3a5f221bcfa5553dc5ac0fd6d4367b
- SSDEEP 196608:cFqgCtak54oVmTP84zCRaOstmrWjUVvRehtsr6f:o6CP8AtOsOWMvksGf
- TLSH
  T1978633C978DE2B71C0ABC3718947216D716A3FC17E61AD0F77C936083E7265668B138A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2