6e0bb30ca4eeeb706d07d93c98d7197d8c186ca51711596ad0e745ef10d5abf3

General

Target
6e0bb30ca4eeeb706d07d93c98d7197d8c186ca51711596ad0e745ef10d5abf3
Size 7.5MB
Sample260801-rt6aha1yb1
SHA256 6e0bb30ca4eeeb706d07d93c98d7197d8c186ca51711596ad0e745ef10d5abf3
MD5 cbfba652aaa384aa59b8e53c853d0f64
SHA1 e069923b8f8431baf5afc7baab8f07218cbab112
SHA512 8c6d5940df09ae2c102f99bf43c2bc9f4a10ac62be5b2416eb39bb403336065196156446459ef20a34fd44f17bfa4acd332d6b9fcac5f52b1f32927dc04e7dcd
SSDEEP 196608:XwxS8M1CKBsk/99ytWz20D3VRbifOCyDGpaJ2/zPOTDCBci:sS9287Vl3CygaSzICyi
TLSH
T1677633C82A7DBB6F43ED2243C5CF9A5CA1DA0BF124487B2F6285402D7E82957E6501DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_c0rd002.msi
- Size 7.6MB
- SHA256 9b5bb01e54d95708454340b3e6f0b4d39beb1f84fdb151297294b9452218fa16
- MD5 8ecaaee64b5fb6100a249f7c8d740b43
- SHA1 94702be8a444e7972b34e372e9a7a12d85493832
- SHA512 3495affec426224e348d9a642a9798e01f9aee0ab339dba56bbf1f0e64df767ace9b704f392f92213709afd999d30129615e7921ccf123fca9995e0dc203dc0b
- SSDEEP 196608:cFqgCtak54oVmTP84zCRaOstmrWjUVvRehtsr6k:o6CP8AtOsOWMvksGk
- TLSH
  T14A8633C978DE2B71C0ABC3718947216D716A3FC17E61AD0F77C936083E7265668B138A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2