Overview

overview

10

Static

static

3

7f8aa15476...ad.exe

windows7-x64

10

7f8aa15476...ad.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    7f8aa15476659321f8fbbda13672eaad

  • Size

    525KB

  • Sample

    240129-lybnssgfgm

  • MD5

    7f8aa15476659321f8fbbda13672eaad

  • SHA1

    f2c8a465b5ceadd84c693eb5c03001ac66d94fe9

  • SHA256

    a1bb9ec28d32150a123428c515553861d73b6a12a0e4ccee3f3c75aabac682e2

  • SHA512

    cd5d552d29c714b2c370d68445156a6b14eaaaae1ebe78bf8a6868ed79a05a731782f439d85667d0311cca65da59381ac561c853e28c92522624f2c314446b67

  • SSDEEP

    12288:ExLd0vAN0wKlP5G85YO7/nf7+9HO3kPqe:8d0vAN0wCP5Gm/nfy9mkSe

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      7f8aa15476659321f8fbbda13672eaad

    • Size

      525KB

    • MD5

      7f8aa15476659321f8fbbda13672eaad

    • SHA1

      f2c8a465b5ceadd84c693eb5c03001ac66d94fe9

    • SHA256

      a1bb9ec28d32150a123428c515553861d73b6a12a0e4ccee3f3c75aabac682e2

    • SHA512

      cd5d552d29c714b2c370d68445156a6b14eaaaae1ebe78bf8a6868ed79a05a731782f439d85667d0311cca65da59381ac561c853e28c92522624f2c314446b67

    • SSDEEP

      12288:ExLd0vAN0wKlP5G85YO7/nf7+9HO3kPqe:8d0vAN0wCP5Gm/nfy9mkSe

    Score
    10/10
    evasionpersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Shared Task Scheduler registry keys

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks