Analysis
-
max time kernel
104s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
01-03-2023 04:56
General
-
Target
RootFinder_Ransomware.bin.exe
-
Size
100KB
-
MD5
a4af347d20fd13f9d07e53ccd7aa5d14
-
SHA1
4d699af90fe02fd16b08316367493ac614e75c91
-
SHA256
0a4d4889a853bc29486d58d8b1010a0b64fd6b6835e28bfda7019b7f1f46e64a
-
SHA512
957a505e1928b8cbd5e1621701bdd08874bb6cc4a0ad42c0e3735dd3b418d39fcf40b0bbd59e3197d77fa457becee81be7d55328019b858fec2dfd3386a42777
-
SSDEEP
3072:YtS8Pqxc/WOcLeaUUEnQKfh9NVgnf0N3XqY:YtS8yG+OcLtUUE1yiHq
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RootFinder_Ransomware.bin.exe"C:\Users\Admin\AppData\Local\Temp\RootFinder_Ransomware.bin.exe"1⤵
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB