Overview

overview

9

Static

static

3

WinSecurit...es.exe

windows7-x64

8

WinSecurit...es.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WinSecurityUpdates.exe

  • Size

    14.0MB

  • Sample

    220926-dk4hnaachj

  • MD5

    81ec54952bb1f2d77755acc1c72a1022

  • SHA1

    f61fa40dd3b1b36f0ef08335653624a9cf0c0fe5

  • SHA256

    eea3cb397782654810eea1c7bfc350a5c4760b9ea776f08de36b8356a1a3c3a7

  • SHA512

    77d0fd17bb91ac80e747b62f177fe8d2c013a2c7d261ceca0d9738109fa8ef957c6e6e3014a8548da76aaddbf5154a277f529902a3cb05d5e8c128e8a26c7e72

  • SSDEEP

    393216:Ncfbl5euWkQSrstR9zCLFKoL205Suuy0kiOJitcCWRmmd:GfblqkrsX9OLF3L2ASuuy/iCo6Z

Score
9/10
evasionpersistencepyinstallerransomwarespywarestealer

Malware Config

Targets

    • Target

      WinSecurityUpdates.exe

    • Size

      14.0MB

    • MD5

      81ec54952bb1f2d77755acc1c72a1022

    • SHA1

      f61fa40dd3b1b36f0ef08335653624a9cf0c0fe5

    • SHA256

      eea3cb397782654810eea1c7bfc350a5c4760b9ea776f08de36b8356a1a3c3a7

    • SHA512

      77d0fd17bb91ac80e747b62f177fe8d2c013a2c7d261ceca0d9738109fa8ef957c6e6e3014a8548da76aaddbf5154a277f529902a3cb05d5e8c128e8a26c7e72

    • SSDEEP

      393216:Ncfbl5euWkQSrstR9zCLFKoL205Suuy0kiOJitcCWRmmd:GfblqkrsX9OLF3L2ASuuy/iCo6Z

    Score
    9/10
    evasionpersistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

2
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks