0ff80abbbd08f8814f5c7287ae5d01150c2f5655f4fb61747b28e5f1170f29ff

General

Target
0ff80abbbd08f8814f5c7287ae5d01150c2f5655f4fb61747b28e5f1170f29ff
Size 5.0MB
Sample260708-vs94vads8l
SHA256 0ff80abbbd08f8814f5c7287ae5d01150c2f5655f4fb61747b28e5f1170f29ff
MD5 7a13dbf299afeb3323ebf870aa3eb00a
SHA1 6a4d8729817a582a7cdefe5f1c7cf7a08dcb79af
SHA512 6f86bbee4420ef25981db8f881cec66e4f07ab13c31417737eca3a9a1e4c3bc7f9b191d0869a357851d60e2d0d3d8ff402f10232a31b6c8d097968e1dd146d87
SSDEEP 98304:FMhtL5xiTk/mkoQw4yKj7EOpSc1jbDjQB9/3+DXkAXRVZD2jc8tXR:GL5xiTkd1yKjNpScxjM9/SkAML
TLSH
T1BE36334B39F50704EBFB5F9607B4C48288E85B3EFC51532C63E2F7F452679486A1622A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zinst.6638258015.msi
- Size 5.2MB
- SHA256 872c8ab96cacb8fee4e93b203164a5ed5ab85fd3b9d67de2d88317a054e48284
- MD5 f1c900b06f3ffaab15f4548fb6d19e0d
- SHA1 a1f3f41b007f29c99bac8401db87a530a08c2b19
- SHA512 92b3344015daa03e71c2fc0709d85f66bcf378c90b59ec0b878cae29f0161d94c8a1060d8a7a2bcb51ff9505b49572a3b972326f6dd7161837d4c9470ea808f5
- SSDEEP 98304:4ByTsw7SGaD1tivkRIUcQaUa6jfUK92s3PpLA9eFnJtM/dWPANhV7V2bcInt9:46aD1tivkzla6jb92shLFnfQWPC0R
- TLSH
  T1444633D9B9C63671D2ABC7B40652A49EBC9C3FD6FEA14C0536D87B001E73A015B3A346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2