6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002

General

Target
zinst.6638258013.msi
Size 7.9MB
Sample260706-tc67kshv41
SHA256 6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002
MD5 7c78cd36b7dbcb2d7aec1afb683e5ce7
SHA1 81d801ae7cce4e54fb070258e5878227fb87c8c0
SHA512 ea8639c4e8e82ddfaeb338abc5c10fda56789d904e682e722f10584f55c48c258278851b2520f63c47cbe51db48ff80ba4d53640a669786344690c8eef135c1f
SSDEEP 196608:dVDuo39jPbm/hnkr+1n++NFUjbPKRbH9aU:dVDuoNTbm/6k/acbdD
TLSH
T1D08633867CCB29B2F403C7B09893622E33667FC58DB84D0976DE775C2C721259DBA246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zinst.6638258013.msi
- Size 7.9MB
- SHA256 6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002
- MD5 7c78cd36b7dbcb2d7aec1afb683e5ce7
- SHA1 81d801ae7cce4e54fb070258e5878227fb87c8c0
- SHA512 ea8639c4e8e82ddfaeb338abc5c10fda56789d904e682e722f10584f55c48c258278851b2520f63c47cbe51db48ff80ba4d53640a669786344690c8eef135c1f
- SSDEEP 196608:dVDuo39jPbm/hnkr+1n++NFUjbPKRbH9aU:dVDuoNTbm/6k/acbdD
- TLSH
  T1D08633867CCB29B2F403C7B09893622E33667FC58DB84D0976DE775C2C721259DBA246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan discovery exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2