Overview

overview

10

Static

static

10

iE8JUAJp7.bin.exe

windows7_x64

8

iE8JUAJp7.bin.exe

windows10_x64

8

Resubmissions

28-10-2021 15:44

211028-s6m55agfbk 10

10-10-2021 17:01

211010-vjzlragafj 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    iE8JUAJp7.bin.zip

  • Size

    140KB

  • Sample

    211028-s6m55agfbk

  • MD5

    06595c8a8b5293727765fbc931d6bfe1

  • SHA1

    ed700f9ebea686f9dd2c5a4f9d6c3e051d1c4452

  • SHA256

    fedb39ac98c39b688703f1968405d75432d881ff34405d3087a989440735aa8e

  • SHA512

    6b4a4bcce470bd755ac1ef20a3a967e2068e58fe9d095a1dd58e6de6a0142488a369ee98904710f02bb6150dc29c93e566feca8d4c25624d512250b50778f607

Score
10/10
thanosevasionpersistenceransomware

Malware Config

Targets

    • Target

      iE8JUAJp7.bin

    • Size

      385KB

    • MD5

      a9a0fae4766d9f7cafa1560f5f62e46f

    • SHA1

      d582608dc07bd9f771334cdb60626755997dd56c

    • SHA256

      f70966e32d18a1e2ed51ebdcc6b985d8f7613febf0680639076c71ebeab6a350

    • SHA512

      5c2f89a16c5291d509f41bd5f12d18a386892738cfd5fb5cbd2156c52d46f28abde5f199461fe9a8bf3aa3f7e4644fe66c3ad48c3b114b792efdbf421468856b

    Score
    8/10
    evasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Downloads PsExec from SysInternals website

      Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks