Overview

overview

8

Static

static

4

Update Pay...on.pdf

windows7_x64

1

Update Pay...on.pdf

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Update Payment Information.pdf

  • Size

    199KB

  • Sample

    210208-aky4rcmel6

  • MD5

    2cb9ea52ddeaf3d57a984bb03fe05f8e

  • SHA1

    9a3601139d9d96749f3afdb3fcda12404d88c0e4

  • SHA256

    d23c626d8568b47ff9055efd1ea569f9fe655a579287a5acc907cc9db95189ec

  • SHA512

    f099f1e8f67e81226b2baea001dbc2a8b97654bd023dc351fae4dcb9b80b2f8be002476dcd421d79f921656c24a83d50fa04e7eb98b5e50bfc15f5623bbce27b

Score
8/10
bootkitlinkpdfransomware

Malware Config

Targets

    • Target

      Update Payment Information.pdf

    • Size

      199KB

    • MD5

      2cb9ea52ddeaf3d57a984bb03fe05f8e

    • SHA1

      9a3601139d9d96749f3afdb3fcda12404d88c0e4

    • SHA256

      d23c626d8568b47ff9055efd1ea569f9fe655a579287a5acc907cc9db95189ec

    • SHA512

      f099f1e8f67e81226b2baea001dbc2a8b97654bd023dc351fae4dcb9b80b2f8be002476dcd421d79f921656c24a83d50fa04e7eb98b5e50bfc15f5623bbce27b

    Score
    8/10
    bootkitransomware

    • Modifies WinLogon to allow AutoLogon

      Enables rebooting of the machine without requiring login credentials.

      ransomwarebootkit
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks