2ea37598aa1e665c4d218cdfee6467540d6a0ac5caf0cbd5d8128a3e777ec7eb

General

Target
2ea37598aa1e665c4d218cdfee6467540d6a0ac5caf0cbd5d8128a3e777ec7eb
Size 8.4MB
Sample260802-tkrrvswele
SHA256 2ea37598aa1e665c4d218cdfee6467540d6a0ac5caf0cbd5d8128a3e777ec7eb
MD5 057ef28c11169baaa39239860f5a816f
SHA1 62adcd8a1ec72245e2f72a1cd2084391eb443322
SHA512 d6f957f302f088311ee56267961c5fcce5450e70c26db923f1456f4a3bc15e4bbdcfd24625a971ba4983db49971f9566b70857d6b63423f45de420a43fe95b99
SSDEEP 196608:1h+6u1PIqEO9ZUJObXws6tN4XuF/qQwKJesUxiqub2A7r437xbU9/G:1ha17EO9ZUUx6tN4XuFiQwn8VP437xwO
TLSH
T1B496338BB9D081BA3551FA449C349B16381035A7AF950DCAFF6450EAFCA879A3C473D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 8.6MB
- SHA256 b42b1befacffe8b4f8cd79426a83109f90fdd2c846b361337183adbed5f66001
- MD5 418c684123a872969dce6fc8732d7388
- SHA1 c362f44d832cac0f303f0b3931d913c42932fb36
- SHA512 ce7334c6ac7dac0b1d9466a266763eeb15291fc5d1b587b77b1c6f33c6529cbf2fac58cf1752d288cbdb7c021158f1372355e8daf951462c4b5115ef4dc9bf38
- SSDEEP 196608:W6WTYIpbo0g4lvOuUdZpEXmPNkCM4X+I4Hmq+r0ARtMhnYJE/JDW:fwp/g4lvOuUdZpEXmPmCMTGVbMhnYk5W
- TLSH
  T1829633C67CC52374D097C7B09823A62D39253FD4BF664C8ABFA87601AC717262977386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2