Overview

overview

8

Static

static

1

ESTE VIDEO...ts.mp4

windows7-x64

8

ESTE VIDEO...ts.mp4

windows10-1703-x64

8

ESTE VIDEO...ts.mp4

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ESTE VIDEO NO TIENE FIN (quedarás atrapado!) #shorts.mp4

  • Size

    2MB

  • Sample

    230327-zh94bafb74

  • MD5

    4e43a22dfdaaca7f89d20aa8295f97c5

  • SHA1

    4fc67fc04b0c6557de6f54dcb82696459823beb6

  • SHA256

    e923e3b0bba03a5b3312ba55b67189d5f0b3cd0e940e526506724a40dc7fed93

  • SHA512

    7a166616b0d99eed9ed30815ca084038e45f63b1da7cc7cbda40da3c0199c8955dc75169acfbb8d17ad0eed08053f64fe5bc2544a5a98056f0cfb3b15a46ce85

  • SSDEEP

    49152:kPnnk/Ay4YuMkWLGxU8Ih1kaNF+M+BPPpkXOnGH72Iv8feRY7WMH:8nPYuWLZ8ITF+1PpkXOGHCIvwfW4

Score
8/10
bootkitpersistenceransomware

Malware Config

Targets

    • Target

      ESTE VIDEO NO TIENE FIN (quedarás atrapado!) #shorts.mp4

    • Size

      2MB

    • MD5

      4e43a22dfdaaca7f89d20aa8295f97c5

    • SHA1

      4fc67fc04b0c6557de6f54dcb82696459823beb6

    • SHA256

      e923e3b0bba03a5b3312ba55b67189d5f0b3cd0e940e526506724a40dc7fed93

    • SHA512

      7a166616b0d99eed9ed30815ca084038e45f63b1da7cc7cbda40da3c0199c8955dc75169acfbb8d17ad0eed08053f64fe5bc2544a5a98056f0cfb3b15a46ce85

    • SSDEEP

      49152:kPnnk/Ay4YuMkWLGxU8Ih1kaNF+M+BPPpkXOnGH72Iv8feRY7WMH:8nPYuWLZ8ITF+1PpkXOGHCIvwfW4

    Score
    8/10
    bootkitpersistenceransomware

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Web Service

1
T1102

Modify Registry

4
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Execution

Exfiltration

Impact

Defacement

1
T1491

Initial Access

Lateral Movement

Persistence

Registry Run Keys / Startup Folder

2
T1060

Bootkit

1
T1067

Privilege Escalation

Tasks