1a16808a5a9a86bc6d5c4e0f40dd67b3d43fadfb8a31581878733100b7fe462d

General

Target
1a16808a5a9a86bc6d5c4e0f40dd67b3d43fadfb8a31581878733100b7fe462d
Size 9.7MB
Sample260803-clltkaan7s
SHA256 1a16808a5a9a86bc6d5c4e0f40dd67b3d43fadfb8a31581878733100b7fe462d
MD5 1e7db9b9a125e00eae141909ed52106e
SHA1 f7cb892be40a5a1106ec59c65c5699db11e0c9d2
SHA512 e91700310c93940ec563301db9ee169b4b437f268e13433812fbc4612343aa507e9a7adeb5fce661b3cb8f36189960164ef375dff4e714f87bb284c2132f2690
SSDEEP 196608:Rc+mQtP2OtMbOk+8M1hCKF/8GcOR48t7B2aBJlqKGawIQ0JwQeldor7GOT5yuWD:Rcf3O+qCcpNtZnN5OvonGH
TLSH
T154A633077E27E2C1861E321EB90E91CB01C975BD9AB1B1D0B28D71472FCE9AF6B4C651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  install_ehe006.msi
- Size 9.8MB
- SHA256 4ec1428e8aca916a08103541511d7560304adefb07a60533735a5d6e0ac668c9
- MD5 883d01b26a9547a3f8fcbbcfa0f1d929
- SHA1 bdacda72c295e51132e2ce53fda3cc5633de385c
- SHA512 ba2a30c83bb46d02cde1330511402bbef204d2043471a841afffa8293223d830b5d17ab33dc5f75158ac0416f49b8554c91fbf42e0d931a0a7814f9a1774b5b9
- SSDEEP 196608:l2cqthMixMRIa2mMtqn0IWK8HtDkY/HlYkW222C0RkyWdTOEnwEhPy6A70:ltLIMHH4DZx97ahOQw30
- TLSH
  T193A63382BDCE23B0D18BD374A50A659E38683FD9BAB258417ADD72012EB37371379750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2