50270d0c0c1b570432db8fc297ecdc2dbaa0cd00079ba5382c8d4ec128e3b6fa

General

Target
50270d0c0c1b570432db8fc297ecdc2dbaa0cd00079ba5382c8d4ec128e3b6fa
Size 8.2MB
Sample260710-jqa17agx2v
SHA256 50270d0c0c1b570432db8fc297ecdc2dbaa0cd00079ba5382c8d4ec128e3b6fa
MD5 6f6414d537edbf1ca65b09feeb9fa636
SHA1 bb6250ae8a934d8da1530012e742050d74cb8f5b
SHA512 5a4f2556fb2d2944abe4ecb88b455bee8d5547ba447598c9994f891517d66a53f259a917a714e12726bbd43cf7256a81bba9cb83310bfffabfbcfa8fa2e50025
SSDEEP 196608:nqD962U2mH/XASJ0dUhZ3KosZYGrH6BZh08/fr1dTlngrya:qDE2UlHo0Z9scBZ2yfTlGt
TLSH
T1069633AA8677D3F825AC2A26A1C3B14F343C1ADC4DB1540DD0FB641F65A4EBE1F912E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zintall.8685330015.msi
- Size 8.4MB
- SHA256 8abbff4cb88d70d3757ca2b0b4ebc390f44e222e3fd8b4547caa174d0d1123ce
- MD5 6e44b6eb31f2819a8d7b0076458b953c
- SHA1 565e4ea7fc82a1310d9dfd9c64892e328dbac26b
- SHA512 eb865b24936e9771ee3790abc35d8d1632033e0a5573014e1c11927b2a809f35b791dc55d12c49af5f35f39e9d85d14bce03a4bafb6ed7e4c71aea75c0933485
- SSDEEP 196608:wW8KWN8qU2wVw9esdIhyfcKqvEIZzgjNhIYPfNF1nvBYx5ZJQ:wfaqUnVpyzqcjNS8VnvMC
- TLSH
  T1929633ABFA8A92B0D05ADB7590C3B29F343D3FC48E704D16B5ED761D1D72A2419B2381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2