Overview

overview

10

Static

static

4KK7.exe

windows7_x64

10

4KK7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4KK7.exe

  • Size

    783KB

  • Sample

    210703-bwq12slan2

  • MD5

    3ff0a091552052c3644fc29cb73526b5

  • SHA1

    1c1b9a015ce7e4d4ec6bd37c85d172d6873a195e

  • SHA256

    ea97137ea1a041c3c00da972b49da8e709b2e66470fbbfd00387745d0e29b365

  • SHA512

    e0abcda86ae6d7025a9bf8ceee39c1431465db7788fbf6f286d0f504183f53d94da3594e7965ff719b2a7cad2349ebbf791f8345f3730f8cfdb7c6f1981e942a

Score
10/10
xmrigminerpersistenceransomwareupx

Malware Config

Targets

    • Target

      4KK7.exe

    • Size

      783KB

    • MD5

      3ff0a091552052c3644fc29cb73526b5

    • SHA1

      1c1b9a015ce7e4d4ec6bd37c85d172d6873a195e

    • SHA256

      ea97137ea1a041c3c00da972b49da8e709b2e66470fbbfd00387745d0e29b365

    • SHA512

      e0abcda86ae6d7025a9bf8ceee39c1431465db7788fbf6f286d0f504183f53d94da3594e7965ff719b2a7cad2349ebbf791f8345f3730f8cfdb7c6f1981e942a

    Score
    10/10
    xmrigminerpersistenceransomwareupx

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Process Discovery

1
T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks