f189e64f7ea6f7dbf3d6f2f80710fa4adab0669150c9a4dff58ebed4c5334176

General

Target
f189e64f7ea6f7dbf3d6f2f80710fa4adab0669150c9a4dff58ebed4c5334176
Size 7.4MB
Sample260802-tphdzscm5x
SHA256 f189e64f7ea6f7dbf3d6f2f80710fa4adab0669150c9a4dff58ebed4c5334176
MD5 0a07cdfcec461424c7b7921e7ecfecbf
SHA1 10de1f3b87381c9e037390e99e890f452e19b6f7
SHA512 646277b34d0dc4da4f418cc4746f2198852dc6105f3d20d0a8b16431c7bc51628f68aac1e03eba9dfe66cae388d60f4a4ad88ee92d43a4080a8523a377c7dc52
SSDEEP 196608:CUF//apPX1upQFr1M7hQU6JO2ujY/RDHNYlI+cpo0zQAl+:L//aNFSOaGU4BPHn1Bf+
TLSH
T1DE7633BAD3BB3CFEC15A53110336912B6CF6A1D8A83DFE881397C0A90555DE68F06764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe006.msi
- Size 7.6MB
- SHA256 86da8b1b93612b4ad7ac359a53fe613068b561ff32dae4368419307685f1ccef
- MD5 3e28ae1e29d55186e49eaaa1fab84026
- SHA1 459f23d6ffbe22d7c540f524cefa9d2a68db32b8
- SHA512 09ba0f841a0631bade4426166f4e0e36587276d0946407497856fb8148d00bce64ee1d97965f31c97d6ca6ea2bc99f7f475d0f3591fadc0e418ed3ce0e090adf
- SSDEEP 196608:ATacFhja9PR1uTUFL3WaNNoT9n7gle0IzEu/eulf:0hjaxXQcWaSnZNZHf
- TLSH
  T1F08633E5B4E93B74C08BC3B14117613E706E3FC4BE79AD4673E9B5140E72A264A36398
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2