Overview

overview

10

Static

static

1

NO-ESCAPE

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NO-ESCAPE

  • Size

    238KB

  • Sample

    240425-lydhdshf28

  • MD5

    52a3b970fc646b36172fd8e3711e493c

  • SHA1

    14a974bc3ac68df8b77b15dc1d02d47c698c99ab

  • SHA256

    7c8bdbdb438ced23ff4aa760f7c2bf82586fd7fa28aad00179bfcbb5d38f2ad4

  • SHA512

    6dc6bfade123c950acb3d10edd4d978c56ca9593114ff7d770612b23ec05335f852b67cc043fe62a4d341fa0755c562b8b7fceb1a0affba7d1f49e600b0518a0

  • SSDEEP

    6144:jwQhiVSgE29xxskm0nayRo3y9ZvZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vi0ZbtF:sQhiVSgE29xxskm0nayRo3y9ZvZJT3CT

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      NO-ESCAPE

    • Size

      238KB

    • MD5

      52a3b970fc646b36172fd8e3711e493c

    • SHA1

      14a974bc3ac68df8b77b15dc1d02d47c698c99ab

    • SHA256

      7c8bdbdb438ced23ff4aa760f7c2bf82586fd7fa28aad00179bfcbb5d38f2ad4

    • SHA512

      6dc6bfade123c950acb3d10edd4d978c56ca9593114ff7d770612b23ec05335f852b67cc043fe62a4d341fa0755c562b8b7fceb1a0affba7d1f49e600b0518a0

    • SSDEEP

      6144:jwQhiVSgE29xxskm0nayRo3y9ZvZJT3CqbMrhryfQNRPaCieMjAkvCJv1Vi0ZbtF:sQhiVSgE29xxskm0nayRo3y9ZvZJT3CT

    Score
    10/10
    evasionpersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

4
T1112

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks