d7e1ef66e16b306b059c366fd952b55ca1187e7e0dcb9967c77752ddc6ed8308

General

Target
d7e1ef66e16b306b059c366fd952b55ca1187e7e0dcb9967c77752ddc6ed8308
Size 7.5MB
Sample260710-sb4jmabv5k
SHA256 d7e1ef66e16b306b059c366fd952b55ca1187e7e0dcb9967c77752ddc6ed8308
MD5 50d46e52a9254522f5163d34e4c1df30
SHA1 056e297ab886d19164e0073bc27a34880e2ce1ca
SHA512 dc2216e8045a258f1b46e06417fcd52c402dde06c1a680543c2481dfd9fdef5da263203a0435f3ec5234761b5398e8bb35b81480aaeb20f421d8f311fba77aa0
SSDEEP 196608:g+nHoIuNmtTBahXF67q99N5xeGOe5Wb/Kvc1q:DnIfeTqp5xeGOe5WZI
TLSH
T1327633325909E1CD89E0D27EA4FAED5BF4381FEC8853A885168841F21F387676E05EF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  zintall.8685330011.msi
- Size 7.6MB
- SHA256 e865ae1d42a7e421762e8296e2b9f13596f3bc31af945f34b38f2671af2f81eb
- MD5 43f18aaa2d825d04253419e66cab1349
- SHA1 b5f4d595a7eea3eca6a45d5bb83a54790d12361c
- SHA512 653a57e19997118ce9f260b548b1d6683253c9231fb4abdd7596470843313f3623822e5edf5723dc95a9d3ead1a4568f50a515bc2c2776a7be55bba71652fd3c
- SSDEEP 196608:0IJ35ikSPBm9zF6BOJ9ZPtGu+op+rd0fQ1l:B1567ORPtGu+op+JP
- TLSH
  T1E6863353BD8A6074C08BCBB554A7E56FB03C3FC58E228C1A76ED755C1C31A2A2A35BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware trojan
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2