6b846c10ae14b07ae923408eb158871ccc8663164b8eefe28750b6c978dd3f92 | Triage

Sharing

General

Target

clownµ.7z
Size

28KB
Sample

220123-tzee3sgbh8
MD5

617119ef06f476c56770f931975680d8
SHA1

807752e7c5bf46a994ad7e54b307f5a635155c1a
SHA256

6b846c10ae14b07ae923408eb158871ccc8663164b8eefe28750b6c978dd3f92
SHA512

4ba366debc88542a223c8966ebf1f67b1676d43b3735c95df45ccbd4e6974d3116df9e88643d4d09de2da59bdac82e318019fd3c57bf6ce55c1ddb39e47a1b92

Score

10^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c
- Size
  
  140KB
- MD5
  
  711486a19e8b011528dee34a5d25776e
- SHA1
  
  7e131940fce4d157d0a338b8285e8e2298e8677d
- SHA256
  
  880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c
- SHA512
  
  9213dc1b1ab70e6672e6bef43a50125e7752de303ddbdbfc5b395f3b228363dd57c036befb21c83945207954575b90021af0d4e1f6872253c20475f3dbc4e894
Score

10^/10

evasion persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Disables Task Manager via registry modification
  evasion
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2

evasionpersistenceransomware