6ad2831339a2a6fc8d140c8718cf38fabef9915409bd32cd86221b515b4be629 | Triage

Sharing

General

Target

SecuriteInfo.com.Win32.Heri.26498.16176
Size

4.8MB
Sample

200707-gwg4hp5qs2
MD5

98208f7fc593255491f1824c24315934
SHA1

5151cf986819bf0546630ee84447b430c6b4c587
SHA256

6ad2831339a2a6fc8d140c8718cf38fabef9915409bd32cd86221b515b4be629
SHA512

6709fa75b845249683c07738c9eabd0df08b872bd406da3be33feab4b4f5139c42f400b0f326c98522c9dee9b991aab0fc21f9f5ca4215436232b79a18248639

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Win32.Heri.26498.16176
- Size
  
  4.8MB
- MD5
  
  98208f7fc593255491f1824c24315934
- SHA1
  
  5151cf986819bf0546630ee84447b430c6b4c587
- SHA256
  
  6ad2831339a2a6fc8d140c8718cf38fabef9915409bd32cd86221b515b4be629
- SHA512
  
  6709fa75b845249683c07738c9eabd0df08b872bd406da3be33feab4b4f5139c42f400b0f326c98522c9dee9b991aab0fc21f9f5ca4215436232b79a18248639
Score

10^/10

evasion trojan persistence ransomware
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

evasiontrojanpersistenceransomware

behavioral2

evasiontrojanpersistenceransomware