hxxps://github[.]com/theevilteam/KILLER-CLOWN-extracted/raw/main/3MB%20Online%20Install[.]exe | Triage

Resubmissions

21/05/2024, 19:57

240521-ypbcwsgg7x 10

21/05/2024, 16:17

240521-trkxwsbf3v 10

21/05/2024, 14:21

240521-rn7w5sha41 10

20/05/2024, 11:20

240520-nfmdpahb49 10

19/05/2024, 06:44

240519-hhgckaeh71 10

Sharing

Copy URL Twitter E-mail

General

Target

https://github.com/theevilteam/KILLER-CLOWN-extracted/raw/main/3MB%20Online%20Install.exe
Sample

240521-ypbcwsgg7x

Score

10^/10

defense_evasion evasion execution impact persistence pyinstaller ransomware trojan

Malware Config

Targets

- Target
  
  https://github.com/theevilteam/KILLER-CLOWN-extracted/raw/main/3MB%20Online%20Install.exe
Score

10^/10

defense_evasion evasion execution impact persistence pyinstaller ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

urlscan1

behavioral1

defense_evasionevasionexecutionimpactpersistencepyinstallerransomwaretrojan