ccf06c11d94a963c7811d233e2660d762e4b9c65941a8683c43ed1929ff5ad02

General

Target
ccf06c11d94a963c7811d233e2660d762e4b9c65941a8683c43ed1929ff5ad02.zip
Size 9.5MB
Sample260706-3pr3vsdt81
SHA256 ccf06c11d94a963c7811d233e2660d762e4b9c65941a8683c43ed1929ff5ad02
MD5 7988676c27bc6f686d98b98e2986d292
SHA1 84e93da48d0bfb2640ccab0eff60c6282f216a53
SHA512 0a84a67bad579b247399cd76ca2cd1a2673eebbcecc43481533efa0bf3143c232cdb959fa72be912e44f9091f3fec59d983940b33db6ee35f138b16a4f9ab1af
SSDEEP 196608:59zFz/aooG+e8/2JPrJVtQ1rURWHo04ACiFDbThRcVxCtlkae336ds3O9IyM/:J/as1XjHt6UsWA9xnkC3kn3Ss3XyW
TLSH
T1CEA63308C279AC3B51C5CEA69F44AF33E4DE8E39412B8CD017AAE96947043F65FDC694
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zinst.6638258014.msi
- Size 9.7MB
- SHA256 37c9f9cb5728ff8deb7f517e451bcc16c698b976b1a9d0104fa0ea9a1ca28cab
- MD5 025bc2d12896d767d43bc88fc4753cb7
- SHA1 7fc05c88235d92c4c113d56cd185bcf81fd09824
- SHA512 70edc7ea516af45f9b99f2b17ce593a4c912143c2439e0602560becf6aaa46289d79e2efa4953f21e0f42dd72e9691df3dc2da02a1028bda60b5ec645340e70d
- SSDEEP 196608:blB/ykYCm1tSdY6vRtAHrM3OBoWwUWKhBPzTbOj7ap3gwG9h6XQJQa9:ZB/yqBvRtgM0wUpn3iaFgF9oQJQa9
- TLSH
  T1BFA6334AB59A6836C017CBB109466B3F705DBFD98EB28C0137EEBB0C5A3273419B8755
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan adware discovery exploit spyware
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2