Overview

overview

10

task1

 

10

task2

 

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c.jpg

  • Size

    952KB

  • Sample

    191016-s3dg7rrb16

  • MD5

    cf28320bf297dadc31406788511a3ccf

  • SHA1

    c33a0adc164a99036efab532acbc9f7961672aab

  • SHA256

    7ae7c8f3cd7c94a5ac6f9d1665fd48bfb5762b207624a6f34432e163a658abc9

  • SHA512

    f113eafa181fd717b8583de4326760ada3c770d216576f5ced001cb4205e161af594f05d060ce99b99a95a12cd6c3b519ed8b30e7eaaf25dfead22e302d2926c

Score
10/10

Malware Config

Targets

    • Target

      1c.jpg

    • Size

      952KB

    • MD5

      cf28320bf297dadc31406788511a3ccf

    • SHA1

      c33a0adc164a99036efab532acbc9f7961672aab

    • SHA256

      7ae7c8f3cd7c94a5ac6f9d1665fd48bfb5762b207624a6f34432e163a658abc9

    • SHA512

      f113eafa181fd717b8583de4326760ada3c770d216576f5ced001cb4205e161af594f05d060ce99b99a95a12cd6c3b519ed8b30e7eaaf25dfead22e302d2926c

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • troldesh family

      family

    • Checks processor name in registry (likely anti-VM)

    • Deletes shadow copies

      ransomware

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Program crash

    • Adds Run entry to start application

      persistence

    • Checks system information in the registry (likely anti-VM)

    • Drops Office document

      dropperexploitermaldoc

    • Modifies service

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    task1task2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

5
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Tasks