62039cbfde0374ec61883db76964a49c04a668908c2e915991397b8311de3959

General

Target
62039cbfde0374ec61883db76964a49c04a668908c2e915991397b8311de3959
Size 9.3MB
Sample260803-cf2ylawdpe
SHA256 62039cbfde0374ec61883db76964a49c04a668908c2e915991397b8311de3959
MD5 71101354010d995d6ca3635204e0ac7d
SHA1 61362ab417bfcedccac79d3b10254098cc75b93e
SHA512 04304b87a36e7ecc8d13ad9b6cf2c416878319814b35b65d87ff5411da7c6f1dcc1aae4e3ea507406d5db6d05fc4bd9990467ac5183e6f1f179ddd19d9fee972
SSDEEP 196608:eEcp4eoeDOHflkYy/YDe5xHPNPkAGmQ+lsV+kqSm+g03A:TectkYyTHPNsAKsRStg0Q
TLSH
T17AA633C7BD03EF73E3DE8C02AB510204BA06B41A57DDAE0353507B98E87DB5C55A9A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 9.5MB
- SHA256 750b2257601d709169d4096033bceb0747dce171d9623b9b79689ecbe1381a99
- MD5 8c52c08e87b4f3c516783a0d97170d38
- SHA1 0e5ff71c6542f6bd5ae357892a5c6e4339910cb6
- SHA512 0053564714804afff0fdaecc5370fbc3d7869ae416f85361de0647c62a832c080cb72a3adf3eddbb5b7c99ad1903036485b3b237cdc0630a4821d74fcb1dae03
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6CjK:0EYjUu32p2rxxc0cGYj6Ce
- TLSH
  T17EA633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2