50230ba558d04bbcf2c9b22c0f3a3fd1258927e9b054b4de8ca49313f1e3649f

General

Target
50230ba558d04bbcf2c9b22c0f3a3fd1258927e9b054b4de8ca49313f1e3649f
Size 5.8MB
Sample260803-cf2mtszzdv
SHA256 50230ba558d04bbcf2c9b22c0f3a3fd1258927e9b054b4de8ca49313f1e3649f
MD5 49ce6b24e595558d339dbda119dc777a
SHA1 102dc11cc15c612deda24a0caf40ec7dfe7f6f48
SHA512 2eb434572a87eea3b441e653100d2fd47408cf57500b1cca17860f97640b4df8010f95278a6f3d09a4480b392fd4fb34fc6d545254c3d2b5d83a73e339d45158
SSDEEP 98304:FdxMg3rSvF1u4Z/VEW6tdzUQtKWLDwxNnckDUOufB4hrnd3GE:FYgSN04ZStqYKWLDwxNRNufc78E
TLSH
T1625633D21C5863A7C9BD357A0F9C21C3BA2715D01ADBE20B0A40F273635DF99E9632E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe008.msi
- Size 5.9MB
- SHA256 d7ce3436a4054d0a131828963446199a323f8d6055d6e7cc9d46c5d20e5890a0
- MD5 29f787d374eb55d42e135be5eba34beb
- SHA1 f10983716a4d50a23d0aeecc74ff830f829fc968
- SHA512 9c4dd39adbffc9860279394a3bf2170d3dcaa1fef1dc9d7131764e4916b25ee192d875ae9a23a358021967aabd2757b129bbd2071252617f2c919de59af7460c
- SSDEEP 98304:bb0FNRDreX52pFNMs3JViayv+JNokBHzzuuyuYBvtKCrUGG7tgdvnRdGDI:bbWNxG2T2s3uvDkhGuyuYBvFrG7I/yE
- TLSH
  T1305633D17D852375C09FC3B14656319E722A3FC47E9B9C0B39E4B7142A33B2998B6389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2