Overview

overview

10

Static

static

90df1d1cb5...d7.exe

windows7_x64

10

90df1d1cb5...d7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90df1d1cb5f3dc7af8a3128b51389d9dbb9273bcd9b7a034c93779cef290a1d7

  • Size

    747KB

  • Sample

    210511-fzm1w6x5tj

  • MD5

    474b9a5aad22aab77e123b0ba9a9582d

  • SHA1

    077385a2f9392e4292ea4a57f93e3050f2f98f76

  • SHA256

    90df1d1cb5f3dc7af8a3128b51389d9dbb9273bcd9b7a034c93779cef290a1d7

  • SHA512

    7d39e088c763cb8dcdddf28d0e2da231cc64edc1015893e12199ad95bb0abcd3d6db7b57b63e5ac96b3760771d6edd54098cc2b3c99f2275e0d366e08cfe7041

Score
10/10
evasionpersistenceransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      90df1d1cb5f3dc7af8a3128b51389d9dbb9273bcd9b7a034c93779cef290a1d7

    • Size

      747KB

    • MD5

      474b9a5aad22aab77e123b0ba9a9582d

    • SHA1

      077385a2f9392e4292ea4a57f93e3050f2f98f76

    • SHA256

      90df1d1cb5f3dc7af8a3128b51389d9dbb9273bcd9b7a034c93779cef290a1d7

    • SHA512

      7d39e088c763cb8dcdddf28d0e2da231cc64edc1015893e12199ad95bb0abcd3d6db7b57b63e5ac96b3760771d6edd54098cc2b3c99f2275e0d366e08cfe7041

    Score
    10/10
    evasionpersistenceransomwarespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

5
T1112

Hidden Files and Directories

1
T1158

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks