62d4af673908696f2cc6395834326dff09f5501ef9e9d73cb0ff81470f9fddce

General

Target
62d4af673908696f2cc6395834326dff09f5501ef9e9d73cb0ff81470f9fddce
Size 9.3MB
Sample260803-chvbjazzfw
SHA256 62d4af673908696f2cc6395834326dff09f5501ef9e9d73cb0ff81470f9fddce
MD5 70f31b58047cf2e264158f06c65b7286
SHA1 86d03186492742c04118f018843684698382fe9a
SHA512 5e9981a7bc5cefaaeaadc6edb45f2ee93de55a82e323dc02fbaa27897ef42b404a5d9f54abf58284fd0189580c1b6675ebf3d9509c1aa26dae4b8024067cb300
SSDEEP 196608:5Ecp4eoeDOHflkYy/YDe5xHPNPkAGmQ+lsV+kqSm+g03m:aectkYyTHPNsAKsRStg0W
TLSH
T15CA633C7BD03EF73E3DE8C02AB510204BA06B41A57DDAE0353507B98E87DB5C55A9A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe007.msi
- Size 9.5MB
- SHA256 6221464be7c605be2472baefb9d8edc071c22eeb8ee4a0749aa2761f51cfd0a6
- MD5 7813166b44d05c4b55f48437cfc3e80e
- SHA1 9961207780774cd433c7c8ee9b3002e250baefab
- SHA512 ea51b94669c1af25b4a1489bc480c2facd6b600e4e201c1f2aaafdb582c46c0f142ce67e4891293a1d1e2e46c051121541abc03e7173d291e54e418835c38adf
- SSDEEP 196608:jaiT8E2kV6vjU8N32p3rPev5rxx5+0ciSEh4nGSN2+6Cj6:0EYjUu32p2rxxc0cGYj6Cu
- TLSH
  T103A633C2BD877B71C19BCB319583242D7C2A7F997AAE8C06338577405C72B2953BA319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2