Modify Registry
Software Packing
Ztarter.exe
Windows Exe (x86-32)
Created 5 years ago
VMRay Threat Identifiers (20 rules, 6809 matches)
| Severity | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | Local AV | Malicious content was detected by heuristic scan | 2 | - | |
5/5 | Reputation | Known malicious file | 1 | Trojan | |
4/5 | OS | Disables a crucial system tool | 1 | - | |
4/5 | File System | Modifies content of user files | 1 | Ransomware | |
4/5 | File System | Renames user files | 1 | Ransomware | |
4/5 | OS | Modifies Windows automatic backups | 1 | - | |
4/5 | Reputation | Contacts known malicious URL | 1 | - | |
3/5 | OS | Disables a Windows system tool | 1 | - | |
2/5 | Anti Analysis | Resolves APIs dynamically to possibly evade static detection | 1 | - | |
2/5 | Information Stealing | Reads sensitive application data | 1 | - | |
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Credentials in Files
Discovery
File and Directory Discovery
Lateral Movement
Collection
Automated Collection
Data from Local System
Command and Control
Standard Application Layer Protocol
Standard Cryptographic Protocol
Exfiltration
Impact
Inhibit System Recovery
Data Encrypted for Impact
Sample Information
| ID | #384257 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| ImpHash | |
| Filename | Ztarter.exe |
| File Size | 2863.50 kB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time: | 2019-12-19 20:12 (UTC+) |
| Analysis Duration: | 00:04:00 |
| Number of Monitored Processes | 10 |
| Execution Successful |  |
| Reputation Enabled | |
| WHOIS Enabled |  |
| Local AV Enabled | |
| YARA Enabled | |
| Number of AV Matches | 3 |
| Number of YARA Matches | 0 |
| Termination Reason | Timeout |
