fe43b43626730d6a9f1f8a88ca374873c45aea162bcb03aa75bcbec9ac59546c | Triage

Sharing

General

Target

sample
Size

19KB
Sample

240818-z9gabaybll
MD5

12e4aba6187f90725ff352c162c7f70c
SHA1

044ce13941760b38c5b2562858fb67735afb8c6c
SHA256

fe43b43626730d6a9f1f8a88ca374873c45aea162bcb03aa75bcbec9ac59546c
SHA512

05fb713dea06249ce3f80b349f9aca3e46b2ccab5accbeb077d12fd3baf60b95eb17f532423990d916a001ca5e5a56c307b2ac6e41b3132e70f2ec3dfcc536ce
SSDEEP

384:s86spa1ocy4/4lbGa5MvhpNvl9ub1S2m0Y3Y06Ib3Vfy1xCejiw:U1ocy4AEaOJpNt9Y3Y3Y06O3lExPiw

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  sample
- Size
  
  19KB
- MD5
  
  12e4aba6187f90725ff352c162c7f70c
- SHA1
  
  044ce13941760b38c5b2562858fb67735afb8c6c
- SHA256
  
  fe43b43626730d6a9f1f8a88ca374873c45aea162bcb03aa75bcbec9ac59546c
- SHA512
  
  05fb713dea06249ce3f80b349f9aca3e46b2ccab5accbeb077d12fd3baf60b95eb17f532423990d916a001ca5e5a56c307b2ac6e41b3132e70f2ec3dfcc536ce
- SSDEEP
  
  384:s86spa1ocy4/4lbGa5MvhpNvl9ub1S2m0Y3Y06Ib3Vfy1xCejiw:U1ocy4AEaOJpNt9Y3Y3Y06O3lExPiw
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

behavioral2

discoveryevasionpersistenceransomwaretrojan