4ede297c2578f3898762ddc93cd85bcf6a3bc0ed3c679f29812b61b05b657b20

General

Target
4ede297c2578f3898762ddc93cd85bcf6a3bc0ed3c679f29812b61b05b657b20
Size 9.3MB
Sample260803-cf29cswdpf
SHA256 4ede297c2578f3898762ddc93cd85bcf6a3bc0ed3c679f29812b61b05b657b20
MD5 25571993d2217c111063ec78373ce5d4
SHA1 e963f1335f87cbd16bb8ee2c7446a459eeda5960
SHA512 69417ba671908e03344174248129806a6a9b6770c209bc71f1f7d4f4c9016cd03d6769ccf6ad65fec1f730646418659179df9a72a7e33f1281f66f1b25918a4f
SSDEEP 196608:mEcp4eoeDOHflkYy/YDe5xHPNPkAGmQ+lsV+kqSm+g03g:7ectkYyTHPNsAKsRStg0Q
TLSH
T163A633C7BD03EF73E3DE8C02AB510204BA06B41A57DDAE0353507B98E87DB5C55A9A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 9.5MB
- SHA256 8c05c21f190a87d6b9d63b51bc7162a510a0306ac7c4d55b89210554f84bc105
- MD5 79394a8421cd0f9b9143874743fa6bd0
- SHA1 0cad684a555349ce530762e59c23d45832e4e5bd
- SHA512 c2e82f314677499a5bf8419f1c7963945334fdbd6f36b15205df0a72067293daadf09332aaae7600bbbed665ef6bbbab251e6da235187fc7e2a0c801ffc68093
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6CjC:0EYjUu32p2rxxc0cGYj6CW
- TLSH
  T1A4A633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2