d65e39766506ab7644c46c4fe6d4aae23451f66a01496262592a508d5e7e3922

General

Target
d65e39766506ab7644c46c4fe6d4aae23451f66a01496262592a508d5e7e3922.zip
Size 5.4MB
Sample260701-t14flaby6v
SHA256 d65e39766506ab7644c46c4fe6d4aae23451f66a01496262592a508d5e7e3922
MD5 314d7c7eec75b5703b115a77c9dbb28c
SHA1 b450324ae017f2fced4fa7c5aa78ed68d4bf537f
SHA512 95eecbc0dd4a99207e1f2fd7bf324363393d49e2c3dba05179859950501be3e51944c55f2fb35194bff8773c80c9bc3cf01e1bd7759c4bfa734777707f4f884d
SSDEEP 98304:KkCb64Ds68uZ80mXawvrachw9vnSmn1jlC10dGHINVU1iIYxZzMhulY:KrbJw63Z80ZNcmZnSmXdUYK1XczSd
TLSH
T1C74633D7F0F84466BBA11A9F1C0E2EA796901258D6AF7B13F775FE7C24D01E19268380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  zinstall-setup63890006.msi
- Size 5.6MB
- SHA256 d7856e0639153f54a7f59659b777467d1e8d66fa21204c3dfb7ea200597e637e
- MD5 c2edd6fe9a2e1fbe2e55f23e3b98b148
- SHA1 84054b9a35d8a020ae04d5c51ee5071234fcb818
- SHA512 0f71399c595a4057554a799c60541063be8db1b0ecd88abb413fa329671a74dc2b35c33265b5129a990d5e3a36e8b5c72dfee75b97c90dd7d7481e4d8d834795
- SSDEEP 98304:tDFmsZhyKy54vQ8MZ4QmN2SvrCi7Cz/zqAz5SxTKFAqgG1uNvCnyUaD1zc3Olv:us3ls4vQLZ4Q1/iGjzqAFe4gwYKnFkzv
- TLSH
  T1095633D1B8DD68B4D0CBD7B209073AAF72283FD4BE6A5C037BE97A281DB22155179344
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence privilege_escalation ransomware adware defense_evasion execution spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2