Overview

overview

10

Static

static

10

iE8JUAJp7.bin.exe

windows7_x64

8

iE8JUAJp7.bin.exe

windows10_x64

8

Resubmissions

28/10/2021, 15:44

211028-s6m55agfbk10

10/10/2021, 17:01

211010-vjzlragafj8

Sharing

Copy URL Twitter E-mail

General

  • Target
    iE8JUAJp7.bin.zip
  • Size 140KB
  • Sample211028-s6m55agfbk
  • SHA256 fedb39ac98c39b688703f1968405d75432d881ff34405d3087a989440735aa8e
  • MD5 SHA1 SHA512
Score
10/10
thanosevasionpersistenceransomware

Malware Config

Targets

    • Target
      iE8JUAJp7.bin
    • Size 385KB
    • SHA256 f70966e32d18a1e2ed51ebdcc6b985d8f7613febf0680639076c71ebeab6a350
    • MD5 SHA1 SHA512
    Score
    8/10
    evasionpersistenceransomware

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Downloads PsExec from SysInternals website

      Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

    • Modifies Windows Firewall

      evasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks