1b7329893c8c0ecb331f48666320aec232ad0ecae4f80763d836c5df6b9d7d32

General

Target
1b7329893c8c0ecb331f48666320aec232ad0ecae4f80763d836c5df6b9d7d32
Size 9.3MB
Sample260803-cf3vwswdqa
SHA256 1b7329893c8c0ecb331f48666320aec232ad0ecae4f80763d836c5df6b9d7d32
MD5 85a0a20dba8e8a3c09ee3f7291193e7d
SHA1 ed65395f56bd9ffbb3ba585aacca6bc5d798e092
SHA512 50eeee8102d17f43d15ab57ae5f3ae4e522ddf318da840356eb299589974eb5eb171a452b54f4dfcbccde361c98c72765eed7642ff05bf67f661ef852607d07a
SSDEEP 196608:HEcp4eoeDOHflkYy/YDe5xHPNPkAGmQ+lsV+kqSm+g03i:gectkYyTHPNsAKsRStg0S
TLSH
T121A633C7BD03EF73E3DE8C02AB510204BA06B41A57DDAE0353507B98E87DB5C55A9A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 9.5MB
- SHA256 0aa9b3d8ae906964843e9310d73e662ffc6d8c17ee332f8bb96cd945738cb3f3
- MD5 0ed0a0100a4938215e8c6fdf965085d9
- SHA1 85ed4fd6cbcc622f9cada544cf32933a40faba43
- SHA512 ba570529ff30866a3bc94eb21ce283d2b933b55449d3f5b7e7dcdc179ac75e618cf2183379a2c65567464b2d064c2af05b659868320a7c391735575b1b08920a
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6CjC:0EYjUu32p2rxxc0cGYj6CW
- TLSH
  T1D9A633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2