General
- Target ransom.exe
- Size 8.4MB
- Sample240609-1h2ydafh93
- SHA256 294cca25a52a8ce7764f2504e1f65ad3ee0dd8d2e701bc910d12c2e24fb367d0
Score
10/10
Malware Config
Targets
-
- Target ransom.exe
- Size 8.4MB
- SHA256 294cca25a52a8ce7764f2504e1f65ad3ee0dd8d2e701bc910d12c2e24fb367d0
Score10/10Adds autorun key to be loaded by Explorer.exe on startup
Modifies visibility of file extensions in Explorer
Renames multiple (314) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
Modifies Installed Components in the registry
Sets file execution options in registry
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Registers COM server for autorun
Adds Run key to start application
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
5Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
5