e737c901b80ad9ed2cd800fec7c2554178c8afab196fb55a0df36acda1324721

Analysis

Target

app/linux/decryptor.elf
Size

1.5MB
MD5

a39b4bea47c4d123f8195a3ffb638a1b
SHA1

e60ef891027ac1dade9562f8b1de866186338da1
SHA256

cdca6936b880ab4559d3d96101e38f0cf58b87d07b0c7bf708d078c2bf209460
SHA512

0d18fa871226bfc4b353e14e114b30af174a0161cd5af308d2c9bbe6f9ccca9689d92a6b0c571ba37a322aa92bb37ed8a3264ab61fda84fba0e777225b370215

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

504 OpenWith.exe

pid	process
504	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\app\linux\decryptor.elf
1⤵
- Modifies registry class
PID:1192

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact