1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26 | Triage

Sharing

General

Target

1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26
Size

824KB
Sample

211007-p9mf8acdb7
MD5

7d17a868abac9de81fe79087eee31471
SHA1

2d3f58ea051db43964243b8aefb7279e45e7bda9
SHA256

1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26
SHA512

85ec6c3cf0908b306712041fc9d971d27349641245c29f126e01443dcc6ccd78530c789b15d345938c194009c890b42f7c95bc65deae1ef7372e5744651f9540

Score

10^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26
- Size
  
  824KB
- MD5
  
  7d17a868abac9de81fe79087eee31471
- SHA1
  
  2d3f58ea051db43964243b8aefb7279e45e7bda9
- SHA256
  
  1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26
- SHA512
  
  85ec6c3cf0908b306712041fc9d971d27349641245c29f126e01443dcc6ccd78530c789b15d345938c194009c890b42f7c95bc65deae1ef7372e5744651f9540
Score

10^/10

evasion persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Disables Task Manager via registry modification
  evasion
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

evasionpersistenceransomware