19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec | Triage

Sharing

General

Target

TheHeadmaster.exe
Size

102KB
Sample

240427-cl33vagh67
MD5

9fc5c56438c659fb4563b12ae8186608
SHA1

51c1d56b47e30c95d9151378a7bbb2b93e74708b
SHA256

19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec
SHA512

78bafaa8b57dc3c88acec0b015a291bf1857593f86b54a4514857523dfd6a95a99a97bcb0a1e9425c127f1958ac1ab5797ecb7a52a72e00ed8c649c7f3d1c475
SSDEEP

3072:V3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:xQ+IFCumUGekHRvEuO3go9kfnQ

Score

10^/10

android discovery evasion linux macos persistence ransomware trojan

Malware Config

Targets

- Target
  
  TheHeadmaster.exe
- Size
  
  102KB
- MD5
  
  9fc5c56438c659fb4563b12ae8186608
- SHA1
  
  51c1d56b47e30c95d9151378a7bbb2b93e74708b
- SHA256
  
  19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec
- SHA512
  
  78bafaa8b57dc3c88acec0b015a291bf1857593f86b54a4514857523dfd6a95a99a97bcb0a1e9425c127f1958ac1ab5797ecb7a52a72e00ed8c649c7f3d1c475
- SSDEEP
  
  3072:V3Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:xQ+IFCumUGekHRvEuO3go9kfnQ
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Abuse Elevation Control Mechanism

Bypass User Account Control

Event Triggered Execution

Change Default File Association

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Defacement

Resource Development

Reconnaissance

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16