thanos | cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Sharing

Copy URL

Twitter E-mail

General

Target

Ransomware.Thanos.zip
Size

145KB
Sample

230417-zvne3shg41
MD5

00184463f3b071369d60353c692be6f0
SHA1

d3c1e90f39da2997ef4888b54d706b1a1fde642a
SHA256

cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
SHA512

baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
SSDEEP

3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD

Score

10^/10

Malware Config

Targets

- Target
  
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- Size
  
  82KB
- MD5
  
  e01e11dca5e8b08fc8231b1cb6e2048c
- SHA1
  
  4983d07f004436caa3f10b38adacbba6a4ede01a
- SHA256
  
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- SHA512
  
  298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
- SSDEEP
  
  1536:PcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEe:UWNGszjoih/NDh/NDuk+XkGAK/hztXcQ
Score

10^/10

evasion persistence ransomware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral1 behavioral2
- Target
  
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- Size
  
  91KB
- MD5
  
  be60e389a0108b2871dff12dfbb542ac
- SHA1
  
  14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
- SHA256
  
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- SHA512
  
  6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
- SSDEEP
  
  1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI
Score

9^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- Size
  
  100KB
- MD5
  
  03b76a5130d0df8134a6bdea7fe97bcd
- SHA1
  
  60053d661ed03cd2a07f6750532e6ef11abcc4e5
- SHA256
  
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- SHA512
  
  d82eb0858819fc50b28910dfe8d537c8e7b0f34bc8953e48e7799b55ffe9320775df38c0ae38420808a0ddd84ea0d0c6b989b4348fcac52bbf2d1af7777091b8
- SSDEEP
  
  3072:P6seqCp31Hgsp9a9GTrda8CAKLTsWkyc:CqCp31Z9a9GTrk8CV/t
Score

1^/10
behavioral5 behavioral6
- Target
  
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- Size
  
  87KB
- MD5
  
  d6d956267a268c9dcf48445629d2803e
- SHA1
  
  cc0feae505dad9c140dd21d1b40b518d8e61b3a4
- SHA256
  
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- SHA512
  
  e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
- SSDEEP
  
  1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr
Score

10^/10

evasion persistence ransomware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Downloads MZ/PE file
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral7 behavioral8

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

File Deletion

Modify Registry

Web Service

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Targets

Contains code to disable Windows Defender

Modifies WinLogon for persistence

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Modifies boot configuration data using bcdedit

Blocklisted process makes network request

Downloads MZ/PE file

Modifies extensions of user files

Checks computer location settings

Drops startup file

Executes dropped EXE

Windows security modification

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Modifies WinLogon

Deletes shadow copies

Downloads MZ/PE file

Modifies extensions of user files

Checks computer location settings

Deletes itself

Drops startup file

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Contains code to disable Windows Defender

Modifies WinLogon for persistence

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Modifies boot configuration data using bcdedit

Blocklisted process makes network request

Downloads MZ/PE file

Modifies extensions of user files

Checks computer location settings

Drops startup file

Executes dropped EXE

Windows security modification

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Modifies WinLogon

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8