General

  • Target

    a2112.exe

  • Size

    919KB

  • Sample

    210803-axpkkfeyjj

  • MD5

    4cd42e7aac7f89edf5764b699b2800d0

  • SHA1

    f309daa9650485d6ef6ceeccdc8c014d425a00fd

  • SHA256

    67ab2abe18b060275763e1d0c73d27c1e61b69097232ed9d048d41760a4533ef

  • SHA512

    0dcf0a9f4b15a355c3da11fbcd2276e9d96bd7b767c3cc2cdf17e3fc0b47483f3ef7f6953fd0ca232c3e9a8603be34b0f6c9d41eaac32ffff66755d8d2400440

Malware Config

Targets

    • Target

      a2112.exe

    • Size

      919KB

    • MD5

      4cd42e7aac7f89edf5764b699b2800d0

    • SHA1

      f309daa9650485d6ef6ceeccdc8c014d425a00fd

    • SHA256

      67ab2abe18b060275763e1d0c73d27c1e61b69097232ed9d048d41760a4533ef

    • SHA512

      0dcf0a9f4b15a355c3da11fbcd2276e9d96bd7b767c3cc2cdf17e3fc0b47483f3ef7f6953fd0ca232c3e9a8603be34b0f6c9d41eaac32ffff66755d8d2400440

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

    • Hive

      A ransomware written in Golang first seen in June 2021.

    • Modifies Windows Defender Real-time Protection settings

    • Modifies security service

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Stops running service(s)

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

3
T1031

Defense Evasion

Impair Defenses

2
T1562

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks