39169b5ace46d77e2d411bd70417a02405013b3c4b1f16958d98571d15449cd0

General

Target
39169b5ace46d77e2d411bd70417a02405013b3c4b1f16958d98571d15449cd0
Size 9.7MB
Sample260802-2z8mxsha96
SHA256 39169b5ace46d77e2d411bd70417a02405013b3c4b1f16958d98571d15449cd0
MD5 3f4793a9a835ef466f8177e5522adde5
SHA1 7c1435885ebb20b00aa64a206901035991865b14
SHA512 d6b6b21ce06c3431366f9f47499f710717f77b63a661f6e4b6e0aaa82ab27701bdda211f13902675f3e8e97981c1672830dc3ea14729de36d22d312e52a77894
SSDEEP 196608:Pc+mQtP2OtMbOk+8M1hCKF/8GcOR48t7B2aBJlqKGawIQ0JwQeldor7GOT5yuWW:Pcf3O+qCcpNtZnN5OvonGa
TLSH
T176A633077E27E2C1861E321EB90E91CB01C975BD9AB1B1D0B28D71472FCE9AF6B4C651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe006.msi
- Size 9.8MB
- SHA256 c9faf5f85b05386ce67f5faf6eb39a0e12322de41922d735281d042391313aa5
- MD5 97b0d815006ad1da1064c0b0165e8c7c
- SHA1 c8fcf381ca6da7a0898528ccc6a37ab0dfe11dd0
- SHA512 bbbf8caa3659e9d0bb47a13e6b911285fccdadb1ed740809ac432f2e6be07420c8e45313c60beeb6f6604e0537d3e94535c5099b036c35a69ad65c9db5255abe
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7D:ltLIMHH4DZx97ahOQw3D
- TLSH
  T1DAA63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2