Overview

overview

10

Static

static

7

HEUR-Troja...d4.exe

windows7-x64

10

HEUR-Troja...d4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HEUR-Trojan.MSIL.Agent.gen-6d8dd5a564523b6f8597dd9009a74395bb48e5e1a85947157ced38034b20b6d4.exe

  • Size

    555KB

  • Sample

    220924-lm7l4aahh3

  • MD5

    0c6298d91e5f0a3317dc6db20dad3609

  • SHA1

    b91c567f479223b7a65fbe44e3429be08fde275a

  • SHA256

    6d8dd5a564523b6f8597dd9009a74395bb48e5e1a85947157ced38034b20b6d4

  • SHA512

    3288babc7f67113fad60d7ad69fd69be3d5f8186c66bde280415046894c6a2bfbcad2659a4facbdf02b74917ca63b55bd5087c25f8f017f5f6e8fd71b2396c8d

  • SSDEEP

    12288:gfp3lxis8EdrQso5hnyRIAPQJno5hnyRIAQq:gfp36sN5snUPjnUQq

Score
10/10
agilenetevasionransomwaretrojan

Malware Config

Targets

    • Target

      HEUR-Trojan.MSIL.Agent.gen-6d8dd5a564523b6f8597dd9009a74395bb48e5e1a85947157ced38034b20b6d4.exe

    • Size

      555KB

    • MD5

      0c6298d91e5f0a3317dc6db20dad3609

    • SHA1

      b91c567f479223b7a65fbe44e3429be08fde275a

    • SHA256

      6d8dd5a564523b6f8597dd9009a74395bb48e5e1a85947157ced38034b20b6d4

    • SHA512

      3288babc7f67113fad60d7ad69fd69be3d5f8186c66bde280415046894c6a2bfbcad2659a4facbdf02b74917ca63b55bd5087c25f8f017f5f6e8fd71b2396c8d

    • SSDEEP

      12288:gfp3lxis8EdrQso5hnyRIAPQJno5hnyRIAQq:gfp36sN5snUPjnUQq

    Score
    10/10
    agilenetevasionransomwaretrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Windows security modification

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

2
T1089

Indicator Removal on Host

1
T1070

File Deletion

3
T1107

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4
T1490

Tasks