Overview

overview

10

Static

static

1

Testing.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Testing.rar

  • Size

    37.8MB

  • Sample

    240428-clqshsec5z

  • MD5

    69f3de6d01d23e959455a1a7ac435633

  • SHA1

    2ac29927e55f8a5c4fce1d66d32e6e1dcef68b3d

  • SHA256

    b1f8813751f175e1d0ed16588d071124fe705adbdc43def34418ec5d707d13e1

  • SHA512

    4ac73f29fcd87eceee4c920b05182d266b07c36ff3e80690456a7eefd0c399fb853621afa093cbe7a2fbf498c510e43b50f457b9d2506fc7c41ede732fe79f40

  • SSDEEP

    786432:5jJd+jVjahozpxhsCuX7zM9QfHCsoCHRVi9nE/8MdAdQ3/4aQItYysEGA:5jqjVj1vRknbCso+GEkCYQP1tYyBGA

Score
10/10
evasionpersistencepyinstallerransomwaretrojan

Malware Config

Targets

    • Target

      Testing.rar

    • Size

      37.8MB

    • MD5

      69f3de6d01d23e959455a1a7ac435633

    • SHA1

      2ac29927e55f8a5c4fce1d66d32e6e1dcef68b3d

    • SHA256

      b1f8813751f175e1d0ed16588d071124fe705adbdc43def34418ec5d707d13e1

    • SHA512

      4ac73f29fcd87eceee4c920b05182d266b07c36ff3e80690456a7eefd0c399fb853621afa093cbe7a2fbf498c510e43b50f457b9d2506fc7c41ede732fe79f40

    • SSDEEP

      786432:5jJd+jVjahozpxhsCuX7zM9QfHCsoCHRVi9nE/8MdAdQ3/4aQItYysEGA:5jqjVj1vRknbCso+GEkCYQP1tYyBGA

    Score
    10/10
    evasionpersistencepyinstallerransomwaretrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies firewall policy service

      evasion

    • Blocklisted process makes network request

    • Disables RegEdit via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Modify Registry

6
T1112

Impair Defenses

3
T1562

Disable or Modify Tools

1
T1562.001

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks