Overview

overview

10

Static

static

UnluckyWare.exe

windows7-x64

10

Resubmissions

14-11-2022 23:13

221114-27l4wsea95 10

29-05-2020 11:41

200529-zk6e3261b2 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UnluckyWare.exe

  • Size

    228KB

  • Sample

    221114-27l4wsea95

  • MD5

    d7924023e6cb8826e6db9c1bb917ee4e

  • SHA1

    d3727664988db585b9d632d2888963019b5e6e11

  • SHA256

    a9c4d78cd5e550155bf8cc080f30d632a15155a6dd55b1d5991b7d40809ce336

  • SHA512

    249102437da4a1a361b082b1683f4a69f7ee48ec7e423d2e0551440b61cbbd9f86ce2bd9b93507f7ffa4d268fb0f8d898870162eeb5eea458db67b50b3091519

  • SSDEEP

    3072:oGLIZFoLxVbHr8VSno3C3lK2lKoojBuI3qY:LLIZ+bbL8Qzs2tojBumq

Score
10/10
unluckywarepersistenceransomware

Malware Config

Targets

    • Target

      UnluckyWare.exe

    • Size

      228KB

    • MD5

      d7924023e6cb8826e6db9c1bb917ee4e

    • SHA1

      d3727664988db585b9d632d2888963019b5e6e11

    • SHA256

      a9c4d78cd5e550155bf8cc080f30d632a15155a6dd55b1d5991b7d40809ce336

    • SHA512

      249102437da4a1a361b082b1683f4a69f7ee48ec7e423d2e0551440b61cbbd9f86ce2bd9b93507f7ffa4d268fb0f8d898870162eeb5eea458db67b50b3091519

    • SSDEEP

      3072:oGLIZFoLxVbHr8VSno3C3lK2lKoojBuI3qY:LLIZ+bbL8Qzs2tojBumq

    Score
    10/10
    unluckywarepersistenceransomware

    • UnluckyWare

      Ransomware first seen in 2020.

      ransomwareunluckyware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Defacement

1
T1491

Tasks