General
-
Target
RLBotGUI.msi
-
Size
22.5MB
-
Sample
240802-1lw7aswemg
-
MD5
3630a2074d466b46687ff9d8c8dab4a8
-
SHA1
da21db383e4d76686f97ae7644f01af796ce85cc
-
SHA256
db94135a654eb737df7e84a2c145755006859b0318f54830d155e49d7deecd8e
-
SHA512
44548fe7b8419254fb5887116a7b596da76b1e5bc3199e1292235087d0e7ce2e5eab663c21f6c17fe792e5f198ea1ddd0268d31a1bbc1a3fbfb73e4c15fad9fb
-
SSDEEP
393216:/L6KytrrxzxiLSlnh6Cqu46LL4lSxeUUGGWE2UkpN8tQ6a6ITngx7746y3af:uKyHzTln0Tur/4lRUJUntQFTgVdm
Static task
static1
Behavioral task
behavioral1
Sample
RLBotGUI.msi
Resource
win11-20240802-en
Malware Config
Extracted
C:\Users\Admin\Downloads\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\Downloads\msg\m_english.wnry
http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect
Extracted
C:\Users\Admin\Downloads\r.wnry
wannacry
Targets
-
-
Target
RLBotGUI.msi
-
Size
22.5MB
-
MD5
3630a2074d466b46687ff9d8c8dab4a8
-
SHA1
da21db383e4d76686f97ae7644f01af796ce85cc
-
SHA256
db94135a654eb737df7e84a2c145755006859b0318f54830d155e49d7deecd8e
-
SHA512
44548fe7b8419254fb5887116a7b596da76b1e5bc3199e1292235087d0e7ce2e5eab663c21f6c17fe792e5f198ea1ddd0268d31a1bbc1a3fbfb73e4c15fad9fb
-
SSDEEP
393216:/L6KytrrxzxiLSlnh6Cqu46LL4lSxeUUGGWE2UkpN8tQ6a6ITngx7746y3af:uKyHzTln0Tur/4lRUJUntQFTgVdm
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file
-
Modifies file permissions
-
Adds Run key to start application
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Legitimate hosting services abused for malware hosting/C2
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1File Deletion
1Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1