Overview

overview

8

Static

static

3

Stand.Laun...2).exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Stand.Launchpad (2).exe

  • Size

    74KB

  • Sample

    240415-etkmksec53

  • MD5

    9c6b82e8191fe81dc873b9aa936eafe3

  • SHA1

    fe0813eabfcd7f6c0c62ef01a327b0f1e222119f

  • SHA256

    87403d832ec357593e22d9fe211daa9f22964b3ecc59cd68a312fe3b8bc9f556

  • SHA512

    d122c04a250f285521fce7c12f6dc2971ad0e7f24c60350b99a128e96160c6da06834303ad9a485be833165752265e083c747c656bc62d854b2be4c41e89edec

  • SSDEEP

    768:x23IuhXaoAaGI7kMSbEjMlnQmndydf4dZIgi2WeLeqMc5tul5scYhb:xt9ZomQMBQmnXdZIgQQN+l5scmb

Score
8/10
discoveryevasionexploitransomware

Malware Config

Targets

    • Target

      Stand.Launchpad (2).exe

    • Size

      74KB

    • MD5

      9c6b82e8191fe81dc873b9aa936eafe3

    • SHA1

      fe0813eabfcd7f6c0c62ef01a327b0f1e222119f

    • SHA256

      87403d832ec357593e22d9fe211daa9f22964b3ecc59cd68a312fe3b8bc9f556

    • SHA512

      d122c04a250f285521fce7c12f6dc2971ad0e7f24c60350b99a128e96160c6da06834303ad9a485be833165752265e083c747c656bc62d854b2be4c41e89edec

    • SSDEEP

      768:x23IuhXaoAaGI7kMSbEjMlnQmndydf4dZIgi2WeLeqMc5tul5scYhb:xt9ZomQMBQmnXdZIgQQN+l5scmb

    Score
    8/10
    discoveryevasionexploitransomware

    • Blocklisted process makes network request

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Possible privilege escalation attempt

      exploit

    • Modifies file permissions

      discovery

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks