Overview

overview

10

Static

static

1

Windscribe_2.5.18.exe

windows10-2004-x64

Resubmissions

12/04/2023, 13:34

230412-qt4w1aea81 10

12/04/2023, 13:31

230412-qscq5acf39 6

Sharing

Copy URL Twitter E-mail

General

  • Target

    Windscribe_2.5.18.exe

  • Size

    18.8MB

  • Sample

    230412-qt4w1aea81

  • MD5

    5729d7f8fff698e46f35abc7d904ece9

  • SHA1

    7017eb70ff16eeaf91e9e9f7d60b938f83fb0169

  • SHA256

    a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475

  • SHA512

    e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7

  • SSDEEP

    393216:aaeuojgBv0B53Y6dwzrR0ncZutc6RDHqgu3LO4QK+N2ubT1EPIg9z5sc:aaHHBMB5I62inUbgua1jN201tksc

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      Windscribe_2.5.18.exe

    • Size

      18.8MB

    • MD5

      5729d7f8fff698e46f35abc7d904ece9

    • SHA1

      7017eb70ff16eeaf91e9e9f7d60b938f83fb0169

    • SHA256

      a58515e3c3b350de864bfd41ebd570724efdffe44e17de571f78da74b5ef7475

    • SHA512

      e7d7c26484daf285cdc0d436ba2e9298cb9594a32181fffc62ce3f2d5bfc894445417e28fd2af8e9c1558d15540be61f8154ac70f275fdec827db881201eace7

    • SSDEEP

      393216:aaeuojgBv0B53Y6dwzrR0ncZutc6RDHqgu3LO4QK+N2ubT1EPIg9z5sc:aaHHBMB5I62inUbgua1jN201tksc

    Score
    10/10
    evasionpersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks