23adebb00fb61ee4f08cf0bb32ca411e3ac3e11963b5651410a3945a1dc48139 | Triage

Sharing

General

Target

PreSetup1 X.bat
Size

151KB
Sample

240420-vqak7sdg8x
MD5

a350842eabbf511f2027408c5b0ba9a6
SHA1

d41988348a107fb87ddac10cf542434b42f482ac
SHA256

23adebb00fb61ee4f08cf0bb32ca411e3ac3e11963b5651410a3945a1dc48139
SHA512

c2c9d2059f0a284ab5ea55f80564f45415a1025da9b5ac2f8a541babaed81bc3d870e7110c5808733538031d12807e34e37750e363d129cf6344659d271bb081
SSDEEP

768:+hs33O6od10EkOGDlsfK2Jd7hP3AveP1PAXiAIO1WuWDIkWZI7S4W4Kzz+xKY6zG:LYpOwR

Score

9^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  PreSetup1 X.bat
- Size
  
  151KB
- MD5
  
  a350842eabbf511f2027408c5b0ba9a6
- SHA1
  
  d41988348a107fb87ddac10cf542434b42f482ac
- SHA256
  
  23adebb00fb61ee4f08cf0bb32ca411e3ac3e11963b5651410a3945a1dc48139
- SHA512
  
  c2c9d2059f0a284ab5ea55f80564f45415a1025da9b5ac2f8a541babaed81bc3d870e7110c5808733538031d12807e34e37750e363d129cf6344659d271bb081
- SSDEEP
  
  768:+hs33O6od10EkOGDlsfK2Jd7hP3AveP1PAXiAIO1WuWDIkWZI7S4W4Kzz+xKY6zG:LYpOwR
Score

9^/10

evasion persistence ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Registers new Print Monitor
  persistence
- Sets file execution options in registry
  persistence
- Stops running service(s)
  evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

evasionpersistenceransomware

behavioral2