4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47 | Triage

Sharing

General

Target

000.exe
Size

6.7MB
Sample

240523-1scq8sac4s
MD5

d5671758956b39e048680b6a8275e96a
SHA1

33c341130bf9c93311001a6284692c86fec200ef
SHA256

4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
SHA512

972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7
SSDEEP

3072:V3LA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuzzo9Y:lLJlC6j0CX4XmvWHVcd62uo9

Score

8^/10

evasion persistence ransomware

Malware Config

Targets

- Target
  
  000.exe
- Size
  
  6.7MB
- MD5
  
  d5671758956b39e048680b6a8275e96a
- SHA1
  
  33c341130bf9c93311001a6284692c86fec200ef
- SHA256
  
  4a900b344ef765a66f98cf39ac06273d565ca0f5d19f7ea4ca183786155d4a47
- SHA512
  
  972e89ed8b7b4d75df0a05c53e71fb5c29edaa173d7289656676b9d2a1ed439be1687beddc6fb1fbf068868c3da9c3d2deb03b55e5ab5e7968858b5efc49fbe7
- SSDEEP
  
  3072:V3LA1++iCeFj0im6X/AXpT8vVMCcHVcdhghUuzzo9Y:lLJlC6j0CX4XmvWHVcd62uo9
Score

8^/10

evasion persistence ransomware
- Disables Task Manager via registry modification
  evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

evasionpersistenceransomware