Overview

overview

8

Static

static

5

Trojan-Ran...er.exe

windows7-x64

8

Trojan-Ran...er.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Trojan-Ransom.Win32.Blocker.evvd-f3b2eb5361f61da68b78eb8c5a5ee0460197fb272ba10bec8bac24474cba30e5

  • Size

    1006KB

  • Sample

    221106-yp968ahge5

  • MD5

    14f9d84fbee2f775596337f56b021838

  • SHA1

    6c6946264dad3aeac3d94efbb63efc3e50d549b8

  • SHA256

    f3b2eb5361f61da68b78eb8c5a5ee0460197fb272ba10bec8bac24474cba30e5

  • SHA512

    ff11cf624e3815a3e8ca94218826e2b7172844c437edb611a9b0f1f647c68940b43047e8809f0d072078206e2e7c39c357941335f4ed150018dfe1a02ffa4b58

  • SSDEEP

    24576:8RmJkcoQricOIQxiZY1iaSkKfFxjMGzN+SNXM:pJZoQrbTFZY1iaSkKfFcSe

Score
8/10
persistence

Malware Config

Targets

    • Target

      Trojan-Ransom.Win32.Blocker.evvd-f3b2eb5361f61da68b78eb8c5a5ee0460197fb272ba10bec8bac24474cba30e5

    • Size

      1006KB

    • MD5

      14f9d84fbee2f775596337f56b021838

    • SHA1

      6c6946264dad3aeac3d94efbb63efc3e50d549b8

    • SHA256

      f3b2eb5361f61da68b78eb8c5a5ee0460197fb272ba10bec8bac24474cba30e5

    • SHA512

      ff11cf624e3815a3e8ca94218826e2b7172844c437edb611a9b0f1f647c68940b43047e8809f0d072078206e2e7c39c357941335f4ed150018dfe1a02ffa4b58

    • SSDEEP

      24576:8RmJkcoQricOIQxiZY1iaSkKfFxjMGzN+SNXM:pJZoQrbTFZY1iaSkKfFcSe

    Score
    8/10
    persistence

    • Adds policy Run key to start application

      persistence

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks