Overview

overview

8

Static

static

3

pretty.exe

windows10-1703-x64

8

pretty.exe

windows10-2004-x64

8

pretty.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pretty.exe

  • Size

    40.1MB

  • Sample

    240528-1snthafb22

  • MD5

    0e289105d4ff83bbe0f872dd362ed6b1

  • SHA1

    37110bd3f4ef46fcf21c8f73917b7a395281ca2f

  • SHA256

    c1b64a1f5f197d061a7027f9b4b142f2d53c66a71c95eb41659c717c703ca562

  • SHA512

    0467b6ff82cea6dc3b770328be3d8636d66f0e598d73fd06bde33715807a19289e67808b694c6358ee0b1ebdb7b704ea44b0e59135079517c783dc2b1bf74833

  • SSDEEP

    786432:Xl0Qvyb0Gpc9dY5DhMLEdE35iWXUR4oyJv7ILp1qeBG+2Z0cZntHw:KQvybbIexCLKo6R4Xv8VkV+2VZntH

Score
8/10
discoveryexploitpyinstallerransomwarespywarestealer

Malware Config

Targets

    • Target

      pretty.exe

    • Size

      40.1MB

    • MD5

      0e289105d4ff83bbe0f872dd362ed6b1

    • SHA1

      37110bd3f4ef46fcf21c8f73917b7a395281ca2f

    • SHA256

      c1b64a1f5f197d061a7027f9b4b142f2d53c66a71c95eb41659c717c703ca562

    • SHA512

      0467b6ff82cea6dc3b770328be3d8636d66f0e598d73fd06bde33715807a19289e67808b694c6358ee0b1ebdb7b704ea44b0e59135079517c783dc2b1bf74833

    • SSDEEP

      786432:Xl0Qvyb0Gpc9dY5DhMLEdE35iWXUR4oyJv7ILp1qeBG+2Z0cZntHw:KQvybbIexCLKo6R4Xv8VkV+2VZntH

    Score
    8/10
    discoveryexploitransomwarespywarestealer

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

3
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks