343fb041221816efda509bef339aedb8d8393bae18a0e8ad1b822842361da0bf

General

Target
343fb041221816efda509bef339aedb8d8393bae18a0e8ad1b822842361da0bf
Size 9.7MB
Sample260802-yr12bsfm3w
SHA256 343fb041221816efda509bef339aedb8d8393bae18a0e8ad1b822842361da0bf
MD5 10e545d0b101108be4ed6ad25fc90a92
SHA1 879e928b83ed3156ae83aa81b1c632bfb8fa4ed2
SHA512 8a5ea6a685bff38f19a9f45f5370d6820e98bd985e69e7f245873c39b460a3450395eae45b196adfea2deb0a5446efc2c2e50a7f96c5aa7ccf2a71b62781c81a
SSDEEP 196608:Qc+mQtP2OtMbOk+8M1hCKF/8GcOR48t7B2aBJlqKGawIQ0JwQeldor7GOT5yuWM:Qcf3O+qCcpNtZnN5OvonGY
TLSH
T192A633077E27E2C1861E321EB90E91CB01C975BD9AB1B1D0B28D71472FCE9AF6B4C651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe006.msi
- Size 9.8MB
- SHA256 7ba3a4aba7aad154fc7cb19abb058f26be44db7b289fe254768da8be3b99e452
- MD5 9ed440ce7bfc9242056d2cd5b8e1f050
- SHA1 4f76f0dff0418dd8031de7474f8db071b2837915
- SHA512 71b7126e3a9b784c986a222dc18cb495d54a472ee2c8d74722d6655b1ca5ebdf8851a9b581a7b4bc51bb17055125d5593c4b0362ded8a307551d066b427b670f
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7Q:ltLIMHH4DZx97ahOQw3Q
- TLSH
  T12CA63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2