d69299761308057d6288300f98222484af40c1ebc98432bcbcc9c737ac219245 | Triage

Resubmissions

13-08-2024 08:41

240813-klh2nstfje 10

13-08-2024 08:34

240813-kgp97aybnm 7

13-08-2024 08:31

240813-ke339stcnh 7

13-08-2024 08:22

240813-j9la9stama 10

13-08-2024 08:15

240813-j5ww7sxeqm 10

13-08-2024 08:11

240813-j3kq6axdpl 6

13-08-2024 08:07

240813-jz4d4aseke 10

Sharing

General

Target

free-vpn-3.2-installer_96-miv1.exe
Size

1.7MB
Sample

240813-klh2nstfje
MD5

2798a45b6137fdc262bc01d6c13a2c7d
SHA1

743587eb5afd358591146b8222d2b97d82cb9d1f
SHA256

d69299761308057d6288300f98222484af40c1ebc98432bcbcc9c737ac219245
SHA512

4c8b70261ec5fe915b2c3dcfb6ff644873adcf0d8abb1ba83be30eb600bf1c7fbd6bbd5d0730a610f129e3492517e7cd77e882e9f7b3bfa214e73bfbd361be1b
SSDEEP

24576:W7FUDowAyrTVE3U5F/XkbjztjfSKh7P/1Ks6vk9XpSwR1HNmJrFxgzUsYz:WBuZrEUcztdqAXpSwRWNQ9Y

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  free-vpn-3.2-installer_96-miv1.exe
- Size
  
  1.7MB
- MD5
  
  2798a45b6137fdc262bc01d6c13a2c7d
- SHA1
  
  743587eb5afd358591146b8222d2b97d82cb9d1f
- SHA256
  
  d69299761308057d6288300f98222484af40c1ebc98432bcbcc9c737ac219245
- SHA512
  
  4c8b70261ec5fe915b2c3dcfb6ff644873adcf0d8abb1ba83be30eb600bf1c7fbd6bbd5d0730a610f129e3492517e7cd77e882e9f7b3bfa214e73bfbd361be1b
- SSDEEP
  
  24576:W7FUDowAyrTVE3U5F/XkbjztjfSKh7P/1Ks6vk9XpSwR1HNmJrFxgzUsYz:WBuZrEUcztdqAXpSwRWNQ9Y
Score

10^/10

discovery evasion persistence ransomware trojan
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Modifies WinLogon for persistence
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan