1fd6dd183483399229dec09d132cc529c980adc410693e3ca501e57eef56b8f3 | Triage

Sharing

General

Target

ROBLOJ.exe
Size

1.0MB
Sample

240706-tdj4fawemd
MD5

3e76feff4b59d8b104be9a7720d1a7ec
SHA1

94fcaccde5b90c951df736f1589376b7004d9fbc
SHA256

1fd6dd183483399229dec09d132cc529c980adc410693e3ca501e57eef56b8f3
SHA512

01633703461d8b1a5186be4c82c9ce64a4132935d1a0991c7dc72daeda505751a01b7e23bc95b9b5f5cd08f869727db4e4a8a0bb215d62ba5a1f3da5db93c976
SSDEEP

24576:ySOarS9W3bvZydJgNP6oTV/4RVph1Pdih840JaVh21ejh4USE:ySNyWrRLQHRhpT40JaVgej6USE

Score

10^/10

defense_evasion discovery evasion execution exploit impact privilege_escalation ransomware trojan upx

Malware Config

Targets

- Target
  
  ROBLOJ.exe
- Size
  
  1.0MB
- MD5
  
  3e76feff4b59d8b104be9a7720d1a7ec
- SHA1
  
  94fcaccde5b90c951df736f1589376b7004d9fbc
- SHA256
  
  1fd6dd183483399229dec09d132cc529c980adc410693e3ca501e57eef56b8f3
- SHA512
  
  01633703461d8b1a5186be4c82c9ce64a4132935d1a0991c7dc72daeda505751a01b7e23bc95b9b5f5cd08f869727db4e4a8a0bb215d62ba5a1f3da5db93c976
- SSDEEP
  
  24576:ySOarS9W3bvZydJgNP6oTV/4RVph1Pdih840JaVh21ejh4USE:ySNyWrRLQHRhpT40JaVgej6USE
Score

10^/10

defense_evasion discovery evasion execution exploit impact privilege_escalation ransomware trojan upx
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables Task Manager via registry modification
  evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Modifies file permissions
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Access Token Manipulation

Create Process with Token

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Indicator Removal

File Deletion

File and Directory Permissions Modification

Access Token Manipulation

Create Process with Token

Direct Volume Access

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Service Stop

Defacement

Resource Development

Reconnaissance

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionexploitimpactprivilege_escalationransomwaretrojanupx