Overview

overview

10

Static

static

Trojan-Ran...er.exe

windows7-x64

10

Trojan-Ran...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan-Ransom.Win32.Blocker.jcen-a6e27d347db58526f86480b3e3800e7d1b46a0681ac13e449d76d67d141fa419

  • Size

    716KB

  • Sample

    221107-g3ylxaedej

  • MD5

    676852391e6057a28b5d62a524d54a50

  • SHA1

    535b04e3afa1976cd4405c37a1cba4bbc463ff59

  • SHA256

    a6e27d347db58526f86480b3e3800e7d1b46a0681ac13e449d76d67d141fa419

  • SHA512

    2bf03735bbc7533227d967170bcb637f5f1dec11b30316dd48a31a051b2a41ee6740fd3457f584295cae11c22040c38364dc6b6f6f173c3f66761528c133ff1e

  • SSDEEP

    6144:+1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqCQFHgTRypa86JQPDHDdx/Qtqa:LOkiCpat4FU6JXKqFZgopaPJQPDHvd

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      Trojan-Ransom.Win32.Blocker.jcen-a6e27d347db58526f86480b3e3800e7d1b46a0681ac13e449d76d67d141fa419

    • Size

      716KB

    • MD5

      676852391e6057a28b5d62a524d54a50

    • SHA1

      535b04e3afa1976cd4405c37a1cba4bbc463ff59

    • SHA256

      a6e27d347db58526f86480b3e3800e7d1b46a0681ac13e449d76d67d141fa419

    • SHA512

      2bf03735bbc7533227d967170bcb637f5f1dec11b30316dd48a31a051b2a41ee6740fd3457f584295cae11c22040c38364dc6b6f6f173c3f66761528c133ff1e

    • SSDEEP

      6144:+1Qv8rK3FQp4LGCr9a9n4FRm6RGMXKqCQFHgTRypa86JQPDHDdx/Qtqa:LOkiCpat4FU6JXKqFZgopaPJQPDHvd

    Score
    10/10
    evasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks