Overview

overview

10

Static

static

3

1.exe

windows10-1703-x64

10

1.exe

windows10-2004-x64

10

1.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1.exe

  • Size

    275KB

  • Sample

    240619-12gfsaybqm

  • MD5

    b61525d88761a974e57c8257c76ec999

  • SHA1

    231893b80d83f297ebdc760d4a1388afd98a4dd6

  • SHA256

    6abd97d20372a17384c5fd928ef5548da218b615247276acd7bf0a62ad3cf6e7

  • SHA512

    0ab047b99ef446056fac3f45b62c1c65fc8675c2fff938ba3c88fe600aa969b030b2d1474bece5305e40a2220fbbdaeb0584a1630fce3b53535bb9a27ee6b53c

  • SSDEEP

    6144:ITR3vnpRfE/UVPy/oCa+LDZWC9z5KIFXWBHdZ6Nba09IdkaNiTN:I3vnpRfzPygCa+DZvXWP09IGC2

Score
10/10
defense_evasionevasionexecutionimpactransomwaretrojan

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.encompossoftware.com
  • Port:
    21
  • Username:
    remoteuser
  • Password:
    Encomposx99

Targets

    • Target

      1.exe

    • Size

      275KB

    • MD5

      b61525d88761a974e57c8257c76ec999

    • SHA1

      231893b80d83f297ebdc760d4a1388afd98a4dd6

    • SHA256

      6abd97d20372a17384c5fd928ef5548da218b615247276acd7bf0a62ad3cf6e7

    • SHA512

      0ab047b99ef446056fac3f45b62c1c65fc8675c2fff938ba3c88fe600aa969b030b2d1474bece5305e40a2220fbbdaeb0584a1630fce3b53535bb9a27ee6b53c

    • SSDEEP

      6144:ITR3vnpRfE/UVPy/oCa+LDZWC9z5KIFXWBHdZ6Nba09IdkaNiTN:I3vnpRfzPygCa+DZvXWP09IGC2

    Score
    10/10
    defense_evasionevasionexecutionimpactransomwaretrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Windows Management Instrumentation

1
T1047

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Direct Volume Access

1
T1006

Hide Artifacts

4
T1564

Hidden Files and Directories

4
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

5
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Tasks