Overview

overview

10

Static

static

3

Sun Servic...er.exe

windows10-1703-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sun Service Spoofer.exe

  • Size

    357KB

  • Sample

    240723-q11sxswcqa

  • MD5

    c4cdae4484c0fb1c3c7fb910c3d12a37

  • SHA1

    5cd536d2ab4e1d53a9ee2f01a4861c5a115544ce

  • SHA256

    4f9dde3711c632d7ccc06c48b0f01ae4e1bc0333c3cc482e48f2fad28cecc999

  • SHA512

    724381add4dd83af9f0d7a8c3b3a9fa65c89a7135d536042cdd45938da4b069964a8eab5246570cb8d7a1dc0f018f3e7e9aa34098da066208d01e24b7e38e06f

  • SSDEEP

    6144:3BlkZvaF4NTBalXzzTSY0F4YRC2PYQqzqkkF5Z9uXnDeekK+vc6vUPSvfKRIsatJ:3oSWNTAZUkzDnDUj8PSd

Score
10/10
agilenetevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      Sun Service Spoofer.exe

    • Size

      357KB

    • MD5

      c4cdae4484c0fb1c3c7fb910c3d12a37

    • SHA1

      5cd536d2ab4e1d53a9ee2f01a4861c5a115544ce

    • SHA256

      4f9dde3711c632d7ccc06c48b0f01ae4e1bc0333c3cc482e48f2fad28cecc999

    • SHA512

      724381add4dd83af9f0d7a8c3b3a9fa65c89a7135d536042cdd45938da4b069964a8eab5246570cb8d7a1dc0f018f3e7e9aa34098da066208d01e24b7e38e06f

    • SSDEEP

      6144:3BlkZvaF4NTBalXzzTSY0F4YRC2PYQqzqkkF5Z9uXnDeekK+vc6vUPSvfKRIsatJ:3oSWNTAZUkzDnDUj8PSd

    Score
    10/10
    agilenetevasionpersistenceransomwaretrojan

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks