df2a4091bf375072cd5ea85cf933108ef154c80a0a4a38b4b5172416a975a269

General

Target
df2a4091bf375072cd5ea85cf933108ef154c80a0a4a38b4b5172416a975a269
Size 9.7MB
Sample260803-abeamathme
SHA256 df2a4091bf375072cd5ea85cf933108ef154c80a0a4a38b4b5172416a975a269
MD5 24882fff7355aa47309c05439a0fdd2d
SHA1 53fd8771d7daf77bd7f95b81bc2b0165b65c1a96
SHA512 b9bf4825ef02ca0cb7adb3ed5c1f7c5efc28b0a2107a09a6dee1b1b9472138b9b62b8feb0ef5a9fb30019e822cee79364cce3aa7d889394e4cb2aa410fb66654
SSDEEP 196608:gc+mQtP2OtMbOk+8M1hCKF/8GcOR48t7B2aBJlqKGawIQ0JwQeldor7GOT5yuWj:gcf3O+qCcpNtZnN5OvonGn
TLSH
T199A633077E27E2C1861E321EB90E91CB01C975BD9AB1B1D0B28D71472FCE9AF6B4C651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe006.msi
- Size 9.8MB
- SHA256 4dd95decabbdbd143a647e2655cb1da9d4d1e335deb38bc661c987e116772baa
- MD5 b24490cb623550404829a49796fe73ee
- SHA1 005d063f38aa383755b2e1525da4f2072ceaef46
- SHA512 51d1bbc1729f684eeb5bf253e2526d786bdd07615b82510cc91945f3e32171a44f46a9069ddc5f1a4b74bde3182456b349e1becf679068401add9d04245ef3d2
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A7L:ltLIMHH4DZx97ahOQw3L
- TLSH
  T1FBA63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2