Overview

overview

9

Static

static

1

SkinPack W...0).exe

windows7-x64

9

SkinPack W...0).exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SkinPack Windows 11 Dark y Light Mode (Windows 7 8.1 y 10).exe

  • Size

    54.0MB

  • Sample

    230120-lr81qaad64

  • MD5

    26027b442df7212f436733b85e1a4aa2

  • SHA1

    ada45868d8f9f70b7a80f6ea0fcb5b7f347499c9

  • SHA256

    0ccf0ae2788bc683e39ea3b5e404c97cd866decdf444dfb177eb8cef1a153f4d

  • SHA512

    36b706b8bcc863a0ebdf34b4a0ac4ffd9f1696beee8b80543a2c2656e65ad54e5ee7de652a2063fe545d9323ed013b5d6ccf7d5379011a0b8ccd27903c46d9a2

  • SSDEEP

    1572864:A30jzjWCOwPvwmRZuivmuCKirHDX03Lf4+q25z:A3yyH8v7RcrDkz4+R5z

Score
9/10
discoveryexploitpersistenceransomwareupx

Malware Config

Targets

    • Target

      SkinPack Windows 11 Dark y Light Mode (Windows 7 8.1 y 10).exe

    • Size

      54.0MB

    • MD5

      26027b442df7212f436733b85e1a4aa2

    • SHA1

      ada45868d8f9f70b7a80f6ea0fcb5b7f347499c9

    • SHA256

      0ccf0ae2788bc683e39ea3b5e404c97cd866decdf444dfb177eb8cef1a153f4d

    • SHA512

      36b706b8bcc863a0ebdf34b4a0ac4ffd9f1696beee8b80543a2c2656e65ad54e5ee7de652a2063fe545d9323ed013b5d6ccf7d5379011a0b8ccd27903c46d9a2

    • SSDEEP

      1572864:A30jzjWCOwPvwmRZuivmuCKirHDX03Lf4+q25z:A3yyH8v7RcrDkz4+R5z

    Score
    9/10
    discoveryexploitpersistenceransomwareupx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Modifies Shared Task Scheduler registry keys

      persistence

    • Possible privilege escalation attempt

      exploit

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks