1290948df44efcfc44f75fc4717945c3c14ce87b66dc476bf0a2595e83e6fe39 | Triage

Resubmissions

21-08-2024 10:47

240821-mvl6sstgng 5

18-08-2024 19:52

240818-ylg19s1dmb 5

18-08-2024 19:49

240818-yjp9vsthkp 6

18-08-2024 19:47

240818-yhk9hs1cle 6

18-08-2024 19:42

240818-yey17stfrj 10

18-08-2024 18:53

240818-xjsjjsydjd 10

Sharing

General

Target

Morenos FINAL 5-28-21.pdf
Size

107KB
Sample

240818-xjsjjsydjd
MD5

449dcc66293d406d6d2123e215121e28
SHA1

e89e93a086ba60df9023151af2d0feccac57529b
SHA256

1290948df44efcfc44f75fc4717945c3c14ce87b66dc476bf0a2595e83e6fe39
SHA512

26b7bb24f437e77168ec01efe58c5e6d229867c8e11d1aabd4c4a2a609afc29e92627ccf5c87b97a68f110cc28667777ad6d6ed483b7326d9c9a84af5785bb05
SSDEEP

3072:x3B1PGaOeIPZwrQOXH93afJ9MVYtB/tVwR8WV:x3B1PtIA93yJJB/QrV

Score

10^/10

discovery evasion pdf persistence ransomware trojan

Malware Config

Targets

- Target
  
  Morenos FINAL 5-28-21.pdf
- Size
  
  107KB
- MD5
  
  449dcc66293d406d6d2123e215121e28
- SHA1
  
  e89e93a086ba60df9023151af2d0feccac57529b
- SHA256
  
  1290948df44efcfc44f75fc4717945c3c14ce87b66dc476bf0a2595e83e6fe39
- SHA512
  
  26b7bb24f437e77168ec01efe58c5e6d229867c8e11d1aabd4c4a2a609afc29e92627ccf5c87b97a68f110cc28667777ad6d6ed483b7326d9c9a84af5785bb05
- SSDEEP
  
  3072:x3B1PGaOeIPZwrQOXH93afJ9MVYtB/tVwR8WV:x3B1PtIA93yJJB/QrV
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan