a4c9ccb8f745318784fec390a67d37729c5605ba7177d56e2549a6c72ff26bbc

General

Target
a4c9ccb8f745318784fec390a67d37729c5605ba7177d56e2549a6c72ff26bbc
Size 9.7MB
Sample260802-2z255sha72
SHA256 a4c9ccb8f745318784fec390a67d37729c5605ba7177d56e2549a6c72ff26bbc
MD5 36f1555ca6eb340faa06d57c5b4419ee
SHA1 1df21a73f16f141fff5731d40d60019fcb752711
SHA512 80823a655010c340704641b34b98129e8ac40f1c5f0b1ff8576c5189daa6041b4235dd6da7d08430f1c77fbbe29e8e674c64160c1ffc0a74850bb233ca9555a3
SSDEEP 196608:hc+mQtP2OtMbOk+8M1hCKF/8GcOR48t7B2aBJlqKGawIQ0JwQeldor7GOT5yuWK:hcf3O+qCcpNtZnN5OvonGG
TLSH
T11DA633077E27E2C1861E321EB90E91CB01C975BD9AB1B1D0B28D71472FCE9AF6B4C651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe006.msi
- Size 9.8MB
- SHA256 52a58e5cd8b05da596713723ae24a8001adb66ceac6f9ce943c8cf40e5e7ba84
- MD5 aa240793105f7796375fc5bbabd03cc9
- SHA1 30fef1045d37c9241e36f9d3326e25641e48f7e6
- SHA512 82611693688468c2f85e629564356b9e6d5b34267d01ff4125bf298aaecc7cb2a59e91dab41024b89704da15b2b2db61f54924db0d5a8029ed0cb96d77659a7c
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7W:ltLIMHH4DZx97ahOQw3W
- TLSH
  T19EA63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2