699c46fab3c3a91ad58f90a2ee0963d19dd3d30536db54bbd070b0a12268d4a8

Sharing

Copy URL Twitter E-mail

General

Target
ZapretTray-0.2.zip
Size 1.5MB
Sample261102-pevt4ss1ds
SHA256 699c46fab3c3a91ad58f90a2ee0963d19dd3d30536db54bbd070b0a12268d4a8
MD5 6af4513e7f19ccda8d32eb5703530a89
SHA1 bf74c48390cd893e2d2f18409dc4d435bb4c4e7b
SHA512 0d6315f5604e0cab3ade9b2db7a7a39a01018b6e86ea7477ddaa49b87a254e3b74b98405a7e36fa674ac5ce27a5405b63cf9d86ae9e9d0d8a7ef195f9d8f39aa
SSDEEP 24576:zdlejXO95NorTSqGx0cAj/Ko3ibh15bvLoHcDjY294tcRqKKxxnB69x3E3:zuTQ5NorTHGxnUta5bvLokMbHKCBUS3
TLSH
T12E7533AAA04BC58BD256633A5C0A0A5445E6F5E130D0EF8E7FD8310CD721CA75BB4E7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Setup.exe
- Size 35KB
- SHA256 8df685cd38454c145386c32064944da7f9072130ca2babc2dbcf9202afb7e5c7
- MD5 8a9cfaeb57a848795235fbb2f75311aa
- SHA1 922567cbe2d658e2dbc7037173ce9dda8f645601
- SHA512 01df767b17c615af1e8f9c81d79f2b1579add8945cea57295679cacac69b39ac07e35bd0e793d941b42ab240f8dc8a94e4cfe5e245b0a94bcde512bc63b7ff8c
- SSDEEP 384:wDbLxvKwyLaZWRVHsIirMG7j7q40wDXWR3Zwa6aal7LR51YYvd+nY8uts04U83:OnxvKMZmPi7jOqXXR51YYVAGs04U8
- TLSH
  T1E7F2090777FCC308E1BE4B7C697245850675FB46A622CB9D2E8F68AC04763759220FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

persistence
behavioral1 behavioral2
- Target
  files\ZapretTray.exe
- Size 91KB
- SHA256 74960b7a5675ac6f49f51f73c4800e73e0788b78e21f5a9741b1e5334bf6b60c
- MD5 9c4654ca19c43b00d349328fad06a120
- SHA1 fffc88bcd17c6cfcf6b6324ce1b8bc8a60fa37ce
- SHA512 54727c4eb9d7f290e918a4b7bf542d6ab1ecadde9af23bac89ee0e999b59307ad7638b0361a2b9831ff426413bbf85f79ac192d47d1e815bf8f8354ddd277f5c
- SSDEEP 1536:n4ZJqnK8Dk/2hEKa62iE3u26USITl2dLFwZLw1YYkHOYx3:MEnK8Ds2r2iE3+siFwZLw1YYkuYx
- TLSH
  T1FE933B4733EC8221E6BF47B8947141910BB2BA53E616EB8C1ECB78DC05B67F14A1539B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral3 behavioral4
- Target
  files\core\bin\WinDivert.dll
- Size 46KB
- SHA256 c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
- MD5 b2014d33ee645112d5dc16fe9d9fcbff
- SHA1 aa69498562d350f2de06954b133e59fac1e57002
- SHA512 37014a018b9cd91b2eaeeccc7c5af3838fcae4d4fe6bb50c7ae32cd5c99423965a3e3efb29499324f6885b8f0c2ee2952cb75ab73db4e8960811abcb46801f15
- SSDEEP 768:Qjf2rf/kxpxI+JEw2VWHDDjQSQX4zTtllgwBqWocwTicI:YuT/CXHDvVQatonTic
- TLSH
  T17423D803F74151B7C429C27083AED352AE22FCC56354F9EF82DEB7952D85E42DB1A606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  files\core\bin\WinDivert64.sys
- Size 91KB
- SHA256 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
- MD5 89ed5be7ea83c01d0de33d3519944aa5
- SHA1 4c9b9c74529399abacc2284de1dead5f2332ee9b
- SHA512 be6530fa0e26441441028b530cd6fc4f900448916e137f92613a1f886c16399d415ddd17f7f8847258cc19c63b1510f2f3068942203c50486e48eed838f9f138
- SSDEEP 1536:AsmCCzg4Klt7jh//NiRMwoGK0tmdsAXixJz48dJ/zuXR:Atzilt/iR5ojGmdsAXoz4k/8R
- TLSH
  T12E935B46B2E240C5F9F6C97895F59253EE31FA90A721C7DF11E0981E4F21BE1AD78322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7
- Target
  files\core\bin\cygwin1.dll
- Size 2.8MB
- SHA256 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
- MD5 a1c82ed072dc079dd7851f82d9aa7678
- SHA1 52f26fa1aee39476f1c13438aec8bf969c78da45
- SHA512 22993e7cee1e7aa69ffe45adf3a329abced7e53d54ffea96dab42fe273c81522252c7b7e98e5af36d2fdec0346c51540e977c6e56b8c08835bac86fa6d04ca59
- SSDEEP 49152:hGniafRcs02/oSqCmB5RMiCwDjUZQjuhKv+TLRlURxKc+tKaZrpu8dhcy1u7MHz:YniGRcsVJqCmB5RMiCwDIS4TBrppUy1J
- TLSH
  T165D55C1BF3A350ECC967C138466BA372BA32B82441347F6E2958CB701F72F51666DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  files\core\bin\winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
- MD5 d498e19bc7a79dd1efcb6b928cbe9909
- SHA1 e660246d9b5de531d8c6ed563919d2690f47d209
- SHA512 03fa6ccc762999e4b5e3c7ed4f4a269d5e7114af52c833842f94fcbca19c3b2edd3c218df247d7616a54d25262f2dc14762a958c620433589ac3c1efa14b379a
- SSDEEP 3072:llblEpda/1ZqNUckRoAHzGDIAaSLECf6CuWhs/JSDxIcdDFth2zp:l/TY5czliX5mhYIcdptyp
- TLSH
  T145145B17F39588F9C462C17896AB5333E932FC452134FA4B9FA4DB212F65E10B12E798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  files\core\general (ALT).bat
- Size 3KB
- SHA256 03daa1e91c59264139110c4fd0216ac57e7387efa1c7abdb0f9c3e65492b5edb
- MD5 5a8b4cd8849bd1c9b22a9182dfaa629f
- SHA1 d54226dc27e92e2116884f9114d4bbee796fa788
- SHA512 09fca6e42dcfde29f53540b8d3c5f9e07ac3198f00d6d4befdf6e77035f999f5370f54316e28670b7cfb60ebe20abb782150af4552450e2b29a276ec7de11d26
- TLSH
  T1E4816BA7E00CDE47F5CD653EF89BA5A420279C8329D6D452839B89F8CC0EDBD684E480
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral12 behavioral13
- Target
  files\core\general (ALT10).bat
- Size 3KB
- SHA256 00a37955e2a8e2c2df1859c7e542c24a26f613373a0930e68b20bdeed08d4863
- MD5 91e4da2117ed62a323d8ccaf4a0e9693
- SHA1 271b25f95c008fb79752f3086c538f3ecb94ea2e
- SHA512 3b7583db9256bd8582afa2860ed4a79b724c174405a8c4fd73a4ab4bda375b3dfbfc9686bbcc066c462e3cc2e74b3b92208f41b36ebbf4f5d74a79dd2240a56b
- TLSH
  T142713CA7E00CDE47F58C697DF89EA5B42127DCC328D6D456439B85E8CC0ECBE584E484
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral14 behavioral15
- Target
  files\core\general (ALT11).bat
- Size 4KB
- SHA256 f11cf901444b7b1de316dae78852449f8d390e2ccd9d5eeb7a03ef732cbd1bae
- MD5 38664ef4dc5812b7e11210f2d565efdd
- SHA1 92fa06a726cf6829dc405224a6b1849c9c462f59
- SHA512 a12c3dbc81e8a9f35f65308aa587044f58ed5e980d6c9bdf77be9beb8fd2062c78395564ab7e2575bcf2a6c70f40e66690954b8bd8e58ba1e87e90313f9912fe
- SSDEEP 96:nL674QGB/GRRQ1zbIKdUGB/GRAVv/GRRQuv/GRA5P+R0ri5+RRLx/:A4QGB/GRRGEVGB/GRkv/GRRDv/GRUP+6
- TLSH
  T16F9137A3E00CEE4AF68E747EF49EA6A5211788C328D6D452439B45E8CD0EDB9194E485
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral16 behavioral17
- Target
  files\core\general (ALT12).bat
- Size 4KB
- SHA256 9b21fa52d50668b162e5e1caf39b56478184a22565588ec4dce92f4a25fb2dd1
- MD5 93d8406c772c53dbf7d93d684d712524
- SHA1 d58db5e1917e0c1708afcc9b605b4641f99792b4
- SHA512 5e567d89bcca3a83e4b689821262f31b76f407590e2e3b2a2f58877e2e3646c91f1d9be2f0a8b84ee3e79dfea9830214c4fcef95f1fd950fd2d1497bc96f900e
- SSDEEP 96:nL674QGB/GRRQ1zoLIiUGB/GRKVv/GRRQuv/GRK5P+REji5+RRLx/:A4QGB/GRRGl1GB/GRav/GRRDv/GReP+g
- TLSH
  T1109149A3E00CEE4AF68D747EF89EE6A4301788C328D6D453439B85E8CC0EDBD594E485
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral18 behavioral19
- Target
  files\core\general (ALT13).bat
- Size 3KB
- SHA256 8eadbd0eac63aa87adaaf07359b815c316614c27cf6b478e4ef9b35c2fd8e7b7
- MD5 82a31bff3556ba00d49834b278e0c642
- SHA1 a3995ec5fd3f91f4186af30218a6596c5a1fc61b
- SHA512 8686b8190250b90de8a5e4abcff08d3320b48f380cecf5f1c66232b03d3ab147992754e5ba6ab3e3882e102a399a92112964ff857a239dc43ff1234a2cf489d6
- TLSH
  T1FE818E63E00CDE47F5CD697EF85FEAA16027888728D6D452539B49E8CC0EDBE684F481
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral20 behavioral21
- Target
  files\core\general (ALT2).bat
- Size 3KB
- SHA256 c9a43d689bae4303b061294aa8ce8dcd5c5a38f19c962391cafeef82bf7b5023
- MD5 f7466f42744a09aed245dc31e05d4620
- SHA1 f008f4c982f90c56d503cb8919547a1cc6e5933a
- SHA512 e4a53daddb8308c1d6025226428c471ebb8a0e209e308453e1da39ea6ef23009524113987b4fec3801d5605698644efd11644f84c6003a93f96c38e4aea34192
- TLSH
  T166610757E00DDE4AB68E783FF89EE5E42017C8C31CD6D452529789E8C84EDFA494E485
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral22 behavioral23
- Target
  files\core\general (ALT3).bat
- Size 3KB
- SHA256 eff9c48a0b379cd1c8f770bd7e64c52dad99e1f7ae082de5bc2fb8a88d9ee43c
- MD5 53bc1c1c7f49ef19f8bc1a336b19c166
- SHA1 6d81e9989c80002378088009f097e60085db70be
- SHA512 6782502ee1e2ed97e06f5215d3775c162e8f4d35a401697a80b9d7a0734572242092a3b4320c1054383c3e4724e6006de7bfe1f779586ed20503f0cac2ed8454
- TLSH
  T129715B93E00CDE46F5CD687EF88EA5B56427888728D6C85152DA49E8CC4EDFA6C4F085
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral24 behavioral25
- Target
  files\core\general (ALT4).bat
- Size 3KB
- SHA256 1565de56c2782c79ce20277081ea39643957d74db2b0df17e4ec493aad43afaf
- MD5 ba4e3711e01e80e8d70eec4c44098d61
- SHA1 13571571e0d6d295172961a5c9021128e726746a
- SHA512 c9c0be5d7dc6f77278da65e4b2d6c83c4d166838400c40b4736155fdeab2a850031ecfc4f8c4813db78a38e909c0c65d9c21a1c7344284878beae8c955543029
- TLSH
  T18E813993E00CDE46F6CDA53EF8ABA6A421179CC318D6D452439B89F8CC0EDBD584E594
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral26 behavioral27
- Target
  files\core\general (ALT5).bat
- Size 2KB
- SHA256 e745729c4785de344b36105407b5b6bdbda17d655be7c314b3aa73826db79272
- MD5 1f035e25fe65433fa229f90f18468ef6
- SHA1 0f4b03120ed08ea11b291940726d119a77d872c3
- SHA512 e6e33b1e907c554cd683ad10c9cd02472516de6b9738bb4ed16bd41dacbc1873bf421cd92a9992cafc084e758753e7b8e386d2da266bac994f4572b202c34f9e
- TLSH
  T13341F397E00DDE46B48DA83EFC5AA5F5601B98C32CE5D466539788E8C84EDAE8C4E484
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral28 behavioral29
- Target
  files\core\general (ALT6).bat
- Size 3KB
- SHA256 c32d3a253a3dcd827b5a6d3a1d903beaeda0e5ee65c1d2d1b0abbfc1f04f3005
- MD5 37ec25f0901fbea19ac76881e634402e
- SHA1 04bf0761db34aae33c00e5e3b00f48ca2a72ce2c
- SHA512 e2052e74adc43a8f5721ec4228b51efdf24054c05e5381b85353ec3a32a0e6b051248d60774ad171cfe5cc65e5aa9da6cd6ce35708a11e3bd796b90f63362428
- TLSH
  T15B611657E00DDE4AB6CEB83FF85EA5E52007C8C31CD6D452529B89E8C84FDBA494E485
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral30 behavioral31
- Target
  files\core\general (ALT7).bat
- Size 3KB
- SHA256 147911332e2734a3a7ff760fbabb1bd44d29e75ed0be12bced734270ec592ac9
- MD5 7f98211bb42a98978221987bc39c6c3e
- SHA1 a2c0c10c2074f090f819d7817bb38b7c6ccaa950
- SHA512 dffd8afa407318abc55777e0b95b398a1298fb3ab6deaf57909e9cf737e6d8f3c17b4e76da5597a09d77e49a6fd51fe97a1e07d7f31a335aef691d2e3944beb5
- TLSH
  T19251F797E00DDE46B68EA83EFC9AA5F52017C8C31CD6D462539789E8C84EDEE4C4E485
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery execution persistence privilege_escalation
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32