General
-
Target
252f1a88526683b9dd18c1a7371533e989578b5118975adf93cd8a0891e3cbef
-
Size
48.1MB
-
Sample
220324-pl3hjadedl
-
MD5
034a5f1dcf1f3c5eb599f43af6866a5b
-
SHA1
caeed5dfc862a892e6331d2e732f25c163b4bb10
-
SHA256
252f1a88526683b9dd18c1a7371533e989578b5118975adf93cd8a0891e3cbef
-
SHA512
a1501596ade4264b34deb90063f8a8602f4f7c89a2d00c018a3ccd774f6c5d07e58f165d62bf45f8d50ec5cd80a20d22de62aa9e70d56e569e3252f28b7325cf
Static task
static1
Behavioral task
behavioral1
Sample
252f1a88526683b9dd18c1a7371533e989578b5118975adf93cd8a0891e3cbef.zip
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
252f1a88526683b9dd18c1a7371533e989578b5118975adf93cd8a0891e3cbef.zip
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\2012_2061648016\english_wikipedia.txt
prometheus
https
http
Targets
-
-
Target
252f1a88526683b9dd18c1a7371533e989578b5118975adf93cd8a0891e3cbef
-
Size
48.1MB
-
MD5
034a5f1dcf1f3c5eb599f43af6866a5b
-
SHA1
caeed5dfc862a892e6331d2e732f25c163b4bb10
-
SHA256
252f1a88526683b9dd18c1a7371533e989578b5118975adf93cd8a0891e3cbef
-
SHA512
a1501596ade4264b34deb90063f8a8602f4f7c89a2d00c018a3ccd774f6c5d07e58f165d62bf45f8d50ec5cd80a20d22de62aa9e70d56e569e3252f28b7325cf
Score10/10-
Modifies system executable filetype association
-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Registers COM server for autorun
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-