3282ea37da7f3ad52559d4b783edd96791fbfcd4530cb33b90424bbb34f72511 | Triage™

Login
Reports

Overview

overview

8

Static

static

3

ZEROAVG.exe

windows10-2004-x64

ZEROAVG.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
ZEROAVG.exe
Size 627.7MB
Sample260708-1vdfjsav9w
SHA256 3282ea37da7f3ad52559d4b783edd96791fbfcd4530cb33b90424bbb34f72511
MD5 5921edb2696d02d2c472545abb0309cc
SHA1 95738ba72778ee77501f0ab9bee3e5821f919147
SHA512 13157bf14b2fbe2962b434c2fe41561a7ab1bbd9469c70cf42119dcc6577921cab56420c7cf78168aef171d35b9a29b9a6768d7b0c193f636640f052f9093273
SSDEEP 12582912:QmmIQlwJq/CrXv0d8zdeChSHrx3TCUGmoAQAJcpZn/TlWk1jhtmG:QoQCJ/rcd8Q5x3TRG1AJcpZ/BD
TLSH
T15469336AE6611EEEC33AC6B71ACA8801AC9B437F5F479F17355874871EC4346B82841F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ZEROAVG.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

11 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation

Behavioral task

behavioral2

Sample

ZEROAVG.exe

Resource

win11ltsc2024-20260706-en

windows11-ltsc_2024-x64

15 signatures

150 seconds

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Targets

- Target
  ZEROAVG.exe
- Size 627.7MB
- SHA256 3282ea37da7f3ad52559d4b783edd96791fbfcd4530cb33b90424bbb34f72511
- MD5 5921edb2696d02d2c472545abb0309cc
- SHA1 95738ba72778ee77501f0ab9bee3e5821f919147
- SHA512 13157bf14b2fbe2962b434c2fe41561a7ab1bbd9469c70cf42119dcc6577921cab56420c7cf78168aef171d35b9a29b9a6768d7b0c193f636640f052f9093273
- SSDEEP 12582912:QmmIQlwJq/CrXv0d8zdeChSHrx3TCUGmoAQAJcpZn/TlWk1jhtmG:QoQCJ/rcd8Q5x3TRG1AJcpZ/BD
- TLSH
  T15469336AE6611EEEC33AC6B71ACA8801AC9B437F5F479F17355874871EC4346B82841F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalation

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalationransomware

© 2018-2026

Terms | Privacy