Overview

overview

10

Static

static

10

1d4db8733c...54.exe

windows7_x64

10

1d4db8733c...54.exe

windows10_x64

10

Resubmissions

29-10-2021 14:41

211029-r2gbcaded2 10

23-03-2021 18:12

210323-jcrea62pfn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554

  • Size

    368KB

  • Sample

    211029-r2gbcaded2

  • MD5

    2a6f56addd8adcbb1a6cc8e1d6090012

  • SHA1

    03227744a280d56267cbef448f7e54a924f46173

  • SHA256

    1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554

  • SHA512

    63d951d531ac8c9be311a73ab3c70f3b0afe77a71bbc949ede5564bc98de523bc324c926cb9d4a49dd25171f62333e645e4a56d9e2b4cceab3976672a4eba2c0

Score
10/10
thanosdiscoveryevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554

    • Size

      368KB

    • MD5

      2a6f56addd8adcbb1a6cc8e1d6090012

    • SHA1

      03227744a280d56267cbef448f7e54a924f46173

    • SHA256

      1d4db8733c5f11ee8fca530aeb4a91069de04b1af64cbe1fa3ae2d3572a6e554

    • SHA512

      63d951d531ac8c9be311a73ab3c70f3b0afe77a71bbc949ede5564bc98de523bc324c926cb9d4a49dd25171f62333e645e4a56d9e2b4cceab3976672a4eba2c0

    Score
    10/10
    discoveryevasionpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Downloads PsExec from SysInternals website

      Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Windows security modification

      evasiontrojan

    • Modifies WinLogon

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks