bfb04862f23279799919338f00d26c55b914ce9a5dbdf41bc8ef61d8ceb56086

General

Target
bfb04862f23279799919338f00d26c55b914ce9a5dbdf41bc8ef61d8ceb56086.zip
Size 5.0MB
Sample260707-c6hmmsgt2w
SHA256 bfb04862f23279799919338f00d26c55b914ce9a5dbdf41bc8ef61d8ceb56086
MD5 78b3b7b9af9116883b9b598d14f5eb82
SHA1 0ff86db54c13a60c08ffd3585d362af63bde1c99
SHA512 c443c7358106a2715a0d0d2e2d386a9814ef833c7cf574f250141697dbab1254b7c72106abd875405507f844943241c78a1a58bd5e21ec824dfc27754ff7dfa6
SSDEEP 98304:GMhtL5xiTk/mkoQw4yKj7EOpSc1jbDjQB9/3+DXkAXRVZD2jc8tXO:rL5xiTkd1yKjNpScxjM9/SkAMw
TLSH
T18136334B39F50704EBFB5F9607B4C48288E85B3EFC51532C63E2F7F452679486A1622A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zinst.6638258015.msi
- Size 5.2MB
- SHA256 012ba7271edb2aab73a0fe0805edaafa0ae27652a2617f0e1eacf06a716e54e2
- MD5 c5de21e8c7eaea1b1a30b42057ce44ae
- SHA1 8187499c3836b18300f32e404a79411565d08bb5
- SHA512 d1c5ebb62ba734bc0491d0bef827daa1496e89a2116c7a705cd62f6c89080663d541fec156f2b9e3a054b144ebac5a91dbf7a3af311080aebc173ab675e56d6a
- SSDEEP 98304:4ByTsw7SGaD1tivkRIUcQaUa6jfUK92s3PpLA9eFnJtM/dWPANhV7V2bcIntt:46aD1tivkzla6jb92shLFnfQWPC0x
- TLSH
  T1EC4633D9B9C63671D2ABC7B40652A49EBC9C3FD6FEA14C0536D87B001E73A015B3A346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan adware discovery exploit spyware
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2