adb740a4d2814f2fc7078d3a81c9c642cc13e9a77e728483b67e6ca668a2e373 | Triage

Sharing

General

Target

malware.txt
Size

7KB
Sample

240519-yalv3seb44
MD5

9c18843bf13af2e38482ac3fe46f4290
SHA1

cc90dab75e362b455262c5e3b612b5dfb04f0b38
SHA256

adb740a4d2814f2fc7078d3a81c9c642cc13e9a77e728483b67e6ca668a2e373
SHA512

8dd8d17346f421c461ce66ca7c1ac9e75bd1c5628a0fa81dc4c59db1dcc7ab23b31d35f6c492ddfa3d862b67311559f6c2c5e4d923d40fdca94c313f1f53c797
SSDEEP

96:qD/+WSNb8mN8r9f4PPfMSHnx2gqoAqb1j8RW8ELzmdPzWdEKuWP2W9Nukim29mQ2:qD/UqrZgX7xXCdPidfbj2Qr

Score

10^/10

discovery evasion execution exploit persistence ransomware trojan

Malware Config

Targets

- Target
  
  malware.txt
- Size
  
  7KB
- MD5
  
  9c18843bf13af2e38482ac3fe46f4290
- SHA1
  
  cc90dab75e362b455262c5e3b612b5dfb04f0b38
- SHA256
  
  adb740a4d2814f2fc7078d3a81c9c642cc13e9a77e728483b67e6ca668a2e373
- SHA512
  
  8dd8d17346f421c461ce66ca7c1ac9e75bd1c5628a0fa81dc4c59db1dcc7ab23b31d35f6c492ddfa3d862b67311559f6c2c5e4d923d40fdca94c313f1f53c797
- SSDEEP
  
  96:qD/+WSNb8mN8r9f4PPfMSHnx2gqoAqb1j8RW8ELzmdPzWdEKuWP2W9Nukim29mQ2:qD/UqrZgX7xXCdPidfbj2Qr
Score

10^/10

discovery evasion execution exploit persistence ransomware trojan
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Creates new service(s)
  persistence execution
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

Service Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Disable or Modify System Firewall

Modify Registry

File and Directory Permissions Modification

Credential Access

Discovery

System Information Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

discoveryevasionexecutionexploitpersistenceransomwaretrojan