Overview

overview

10

Static

static

ee717052ab...64.exe

windows7-x64

10

ee717052ab...64.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ee717052ab81a17b84b87518c890ed87ab4eaee41b6e3cfc15a11b22c8532f64

  • Size

    323KB

  • Sample

    221205-z6bwesbg6s

  • MD5

    ac813482f3ecd5e21532e1a187171a2c

  • SHA1

    10efdfe748401ef46f805ad965ab935e593364b0

  • SHA256

    ee717052ab81a17b84b87518c890ed87ab4eaee41b6e3cfc15a11b22c8532f64

  • SHA512

    813a8cbfa712bfa0b39a233b3e36b903168901c94ea8262c7ae07014fa42921b53a97bffb3a19d76cd522962d0039806bd42e840aa95b700720b07a235da7be8

  • SSDEEP

    6144:jBxeN/Tdx8YzL+4eBDgelLBL9C5553TV5n+yNXavM:jBxe9dx8Yz6nhtL9C5553TV5n+4av

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      ee717052ab81a17b84b87518c890ed87ab4eaee41b6e3cfc15a11b22c8532f64

    • Size

      323KB

    • MD5

      ac813482f3ecd5e21532e1a187171a2c

    • SHA1

      10efdfe748401ef46f805ad965ab935e593364b0

    • SHA256

      ee717052ab81a17b84b87518c890ed87ab4eaee41b6e3cfc15a11b22c8532f64

    • SHA512

      813a8cbfa712bfa0b39a233b3e36b903168901c94ea8262c7ae07014fa42921b53a97bffb3a19d76cd522962d0039806bd42e840aa95b700720b07a235da7be8

    • SSDEEP

      6144:jBxeN/Tdx8YzL+4eBDgelLBL9C5553TV5n+yNXavM:jBxe9dx8Yz6nhtL9C5553TV5n+4av

    Score
    10/10
    evasionpersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies system executable filetype association

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks