Overview

overview

10

Static

static

hjgkdf.exe

windows7_x64

10

hjgkdf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hjgkdf.exe

  • Size

    24KB

  • Sample

    210421-78cl1tdm82

  • MD5

    dbe70b82bd05e88df18ff1685eaa9e99

  • SHA1

    cd3e57c6d265882c07e9c7ab9b13f4dc50f46e2a

  • SHA256

    4fb6e836e9ce7b0ef9a7b40cb50f82613450180e31c63e117589d3579f656244

  • SHA512

    6197c0f25aa2c9fe22b2b9e2e31e1e164a72fbb34c69b7a6b115b77ec5e39e91d0d04921487c1261b0999090269e999b2d9e3fe80a25a0a60bd0fc99acefc09e

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      hjgkdf.exe

    • Size

      24KB

    • MD5

      dbe70b82bd05e88df18ff1685eaa9e99

    • SHA1

      cd3e57c6d265882c07e9c7ab9b13f4dc50f46e2a

    • SHA256

      4fb6e836e9ce7b0ef9a7b40cb50f82613450180e31c63e117589d3579f656244

    • SHA512

      6197c0f25aa2c9fe22b2b9e2e31e1e164a72fbb34c69b7a6b115b77ec5e39e91d0d04921487c1261b0999090269e999b2d9e3fe80a25a0a60bd0fc99acefc09e

    Score
    10/10
    evasionpersistencetrojanransomware

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

2
T1089

Bypass User Account Control

1
T1088

Credential Access

Discovery

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks