0fe3174a9efe12d1c80a1c41df2a0df4e24b34e4aabb7c8e3c8dbc323046ea0e | Triage

Sharing

General

Target

PreSetup 2.exe
Size

226KB
Sample

240420-m3lj8sfd9w
MD5

13f52b5eb6d4ca2fa9b6bcb6a706f80a
SHA1

c032838e55f598ef2b2de9d26d056e5a2bfcc08e
SHA256

0fe3174a9efe12d1c80a1c41df2a0df4e24b34e4aabb7c8e3c8dbc323046ea0e
SHA512

a6c4b1c5f108af3971924a958cb1e5d1010b1da10d3c183fbe550e551efd583152ccc7505b0580cd4f866552af8a51eeb080e1181d4bfb53f28a0a7700ef3c42
SSDEEP

3072:FDFfHgTWmCRkGbKGLeNTBfNOwitsxAC+CzIlzFlg:x5aWbksiNTB1OwLxXMlBlg

Score

10^/10

discovery evasion exploit persistence ransomware

Malware Config

Targets

- Target
  
  PreSetup 2.exe
- Size
  
  226KB
- MD5
  
  13f52b5eb6d4ca2fa9b6bcb6a706f80a
- SHA1
  
  c032838e55f598ef2b2de9d26d056e5a2bfcc08e
- SHA256
  
  0fe3174a9efe12d1c80a1c41df2a0df4e24b34e4aabb7c8e3c8dbc323046ea0e
- SHA512
  
  a6c4b1c5f108af3971924a958cb1e5d1010b1da10d3c183fbe550e551efd583152ccc7505b0580cd4f866552af8a51eeb080e1181d4bfb53f28a0a7700ef3c42
- SSDEEP
  
  3072:FDFfHgTWmCRkGbKGLeNTBfNOwitsxAC+CzIlzFlg:x5aWbksiNTB1OwLxXMlBlg
Score

10^/10

discovery evasion exploit persistence ransomware
- Modifies firewall policy service
  evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Modifies Windows Firewall
  evasion
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Sets file execution options in registry
  persistence
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers COM server for autorun
  persistence
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify System Firewall

File and Directory Permissions Modification

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Service Stop

Defacement

Resource Development

Reconnaissance

Tasks

static1

behavioral1

discoveryevasionexploitpersistenceransomware

behavioral2