d2fe211b9df29f4da90bd52649f79bb57ecccdaf76ab9376b8ac80c15e10dfbb

General

Target
zinst.6638258007.zip
Size 7.7MB
Sample260708-ag29msg15j
SHA256 d2fe211b9df29f4da90bd52649f79bb57ecccdaf76ab9376b8ac80c15e10dfbb
MD5 673a599d3c0fb6c5334e5d1930bcdeb2
SHA1 04ba5067c3026ae0da0518536a925a56af8c87f4
SHA512 d5ea83ae7f7592d8e8e34d20e0a3c029620a2d1b8687e972eaff940d3b1cccf38b06858a5fe3423d0891923916edc962ba44e6bf49e7214380574e23e9ffb5a5
SSDEEP 196608:aDH1ogMjcNKuVu3KIfJun/03urCqSKZSn5tN/tc0jj9WSZl:aTXNpqfcns3uVSK4DN/eij9WSL
TLSH
T15C8633C6185E93674E2C338B5E2C5A1B1336519F7FF55BF8A1C2C8BB7322426124A79C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zinst.6638258007.msi
- Size 7.9MB
- SHA256 33f3fe80a074334ce6416f53d60f85390b6efa919169f93c1af4c92f3734dbea
- MD5 8214de081534defc64cbcc305bac1267
- SHA1 987e303bd3c2ce79428941c49b78c7ebe96004d4
- SHA512 7d43d72ada2fecb3f487f2a2adce0c4cf08cb72805fca43fdbd23905e28188980c6e10057553b6ccf6d684aed7ed3b4438410b583fb23099e923a571923ad224
- SSDEEP 196608:qUV55WM4PgZyGlpYP5ovOx/Hli9BsHSlNV7LF4QNN/OkNu:P7QAlSPKvOR0Bsyt7LiMN/OkU
- TLSH
  T1428633856CCB5231C45BE3B00A48157F326E3FCA6FB44E2E36E6B55D3E3242944B6789
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan exploit
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2