0a4d4889a853bc29486d58d8b1010a0b64fd6b6835e28bfda7019b7f1f46e64a | Triage

Sharing

General

Target

RootFinder_Ransomware.bin.exe
Size

100KB
Sample

230301-fkn43sef64
MD5

a4af347d20fd13f9d07e53ccd7aa5d14
SHA1

4d699af90fe02fd16b08316367493ac614e75c91
SHA256

0a4d4889a853bc29486d58d8b1010a0b64fd6b6835e28bfda7019b7f1f46e64a
SHA512

957a505e1928b8cbd5e1621701bdd08874bb6cc4a0ad42c0e3735dd3b418d39fcf40b0bbd59e3197d77fa457becee81be7d55328019b858fec2dfd3386a42777
SSDEEP

3072:YtS8Pqxc/WOcLeaUUEnQKfh9NVgnf0N3XqY:YtS8yG+OcLtUUE1yiHq

Score

10^/10

evasion trojan

Malware Config

Targets

- Target
  
  RootFinder_Ransomware.bin.exe
- Size
  
  100KB
- MD5
  
  a4af347d20fd13f9d07e53ccd7aa5d14
- SHA1
  
  4d699af90fe02fd16b08316367493ac614e75c91
- SHA256
  
  0a4d4889a853bc29486d58d8b1010a0b64fd6b6835e28bfda7019b7f1f46e64a
- SHA512
  
  957a505e1928b8cbd5e1621701bdd08874bb6cc4a0ad42c0e3735dd3b418d39fcf40b0bbd59e3197d77fa457becee81be7d55328019b858fec2dfd3386a42777
- SSDEEP
  
  3072:YtS8Pqxc/WOcLeaUUEnQKfh9NVgnf0N3XqY:YtS8yG+OcLtUUE1yiHq
Score

10^/10

evasion trojan
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2