594d2c4cf357d78f31f19ff90da4a9b0b43ac53c6ac51742d1afda75e97e9007

General

Target
594d2c4cf357d78f31f19ff90da4a9b0b43ac53c6ac51742d1afda75e97e9007
Size 9.3MB
Sample260803-cf3j5azzdx
SHA256 594d2c4cf357d78f31f19ff90da4a9b0b43ac53c6ac51742d1afda75e97e9007
MD5 aea201ae611afb06e6238bd3eed9ba80
SHA1 30090aae6da78e3bc87f397859fef743de33a0a1
SHA512 3dac565ace6e2f1912a2e832f477ae52a7b5b17370357533967281e5910e067a153a696e0f46e4cbf1b3eee5cdade84e85c3d9823e4bf2547d21aed35a367a2c
SSDEEP 196608:IEcp4eoeDOHflkYy/YDe5xHPNPkAGmQ+lsV+kqSm+g03d:dectkYyTHPNsAKsRStg0t
TLSH
T1FEA633C7BD03EF73E3DE8C02AB510204BA06B41A57DDAE0353507B98E87DB5C55A9A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 9.5MB
- SHA256 0ed7c04c2c56856bd1a221b963282b36ba22e58974c7a79569323fd243717804
- MD5 d3ebf788f223a043da527da8b30a4dee
- SHA1 dfa1ddaad74e84e7cc7b80316f9c401bd20e6b78
- SHA512 90582b4be2eaf9c4f089f5de7eb94f40ba6086a6c9218354ec84c33feebb2ba7625b552bc7f75d6f2ed28955fcdc04ad3c56b9b0b13c3f72cbb73d18d4b4fda1
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6Cj6:0EYjUu32p2rxxc0cGYj6Cu
- TLSH
  T193A633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2