Overview

overview

10

Static

static

7

ScaryInstaller.exe

windows7-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ScaryInstaller.exe

  • Size

    21.5MB

  • Sample

    240427-lp951afh62

  • MD5

    ac9526ec75362b14410cf9a29806eff4

  • SHA1

    ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

  • SHA256

    5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

  • SHA512

    29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

  • SSDEEP

    393216:8c68zOv/h4ZPW+Fsx5QiaamSf8iqTCqcvgQYp6veX0N/9FRI9qo6xE:8j1hY++ViaamEhF5vvY2/VI9qK

Score
10/10
evasionransomwaretrojanupx

Malware Config

Targets

    • Target

      ScaryInstaller.exe

    • Size

      21.5MB

    • MD5

      ac9526ec75362b14410cf9a29806eff4

    • SHA1

      ef7c1b7181a9dc4e0a1c6b3804923b58500c263d

    • SHA256

      5ae89b053a9c8e4ad9664b6d893998f281f2864c0f625a536400624d4fbd0164

    • SHA512

      29514a83a5bb78439ee8fb9d64b9e0885f4444fb7f02cefdee939984bb80f58493b406787c53f9a4bf521b2c03af4c3e3da4d5033eee8095b2ab0e753534e621

    • SSDEEP

      393216:8c68zOv/h4ZPW+Fsx5QiaamSf8iqTCqcvgQYp6veX0N/9FRI9qo6xE:8j1hY++ViaamEhF5vvY2/VI9qK

    Score
    10/10
    evasionransomwaretrojanupx

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks