67ca231f52468dfb5cc7d6bf4176a41e517cc717dfb42ded7c011b50ce90f332

General

Target
67ca231f52468dfb5cc7d6bf4176a41e517cc717dfb42ded7c011b50ce90f332
Size 9.3MB
Sample260803-cf3vwswdph
SHA256 67ca231f52468dfb5cc7d6bf4176a41e517cc717dfb42ded7c011b50ce90f332
MD5 be024fee3d73ec6a4a2566f26fc9525c
SHA1 3bb8c714282c4b3a162d494cb17eab90359c2223
SHA512 056a3e60aa7cfbf8423ff4cf74cebbaa429e1b65f74ada6a17012921e16c3688bdc3a8fd696ba6e350948ff68a2559a817d5eca6eb477370e49b36dfe232668b
SSDEEP 196608:NEcp4eoeDOHflkYy/YDe5xHPNPkAGmQ+lsV+kqSm+g03C:mectkYyTHPNsAKsRStg0y
TLSH
T1DEA633C7BD03EF73E3DE8C02AB510204BA06B41A57DDAE0353507B98E87DB5C55A9A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 9.5MB
- SHA256 9b34e9566d86de77a26422fe0d19dc325a438727bf2b236002597df8b4d42e9d
- MD5 8b15b57b7b99c5a7082571849c475d71
- SHA1 0586d2bbd0cf23ca41b279c32435e9f096c5747f
- SHA512 78a28d5d91fcf451adab0cae40a09f125f63896ba87e881fdcd97023fad11465d2ce78dfbd223ae779f545ec7e7dcbbb56d58f57b5100d1cda1e15ffd6d452b8
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6CjS:0EYjUu32p2rxxc0cGYj6CG
- TLSH
  T1DDA633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2