Overview

overview

8

Static

static

3

VineMEMZ.exe

windows10-1703-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    VineMEMZ.exe

  • Size

    39.5MB

  • Sample

    240909-b6klkaycna

  • MD5

    918ae52d5ce2ad8c777945a03a0fd822

  • SHA1

    243fbeb061e11c501849ccd9a6e8a5a55ae8ee24

  • SHA256

    8f4c08c2d9816a8eac8e53f00f249eb9d2fff8702b49a8b503754933547edd03

  • SHA512

    b238286ebfdff477a500fa744aa6ff320e06f2904b064986106862a407639ca3a5e6776c167afff105626beef4158bd88a7101b1511917e6785090c17fb905c1

  • SSDEEP

    786432:77pqEfrm7X+BffCsMPldsctgbMWfUfT5LsuxRIWm69a9BIg2z8F4N3PwLbi9MRpJ:73KSysMPD1tgbMWfe5LsGFFavMoQoLbv

Score
8/10
bootkitdiscoverypersistenceransomware

Malware Config

Targets

    • Target

      VineMEMZ.exe

    • Size

      39.5MB

    • MD5

      918ae52d5ce2ad8c777945a03a0fd822

    • SHA1

      243fbeb061e11c501849ccd9a6e8a5a55ae8ee24

    • SHA256

      8f4c08c2d9816a8eac8e53f00f249eb9d2fff8702b49a8b503754933547edd03

    • SHA512

      b238286ebfdff477a500fa744aa6ff320e06f2904b064986106862a407639ca3a5e6776c167afff105626beef4158bd88a7101b1511917e6785090c17fb905c1

    • SSDEEP

      786432:77pqEfrm7X+BffCsMPldsctgbMWfUfT5LsuxRIWm69a9BIg2z8F4N3PwLbi9MRpJ:73KSysMPD1tgbMWfe5LsGFFavMoQoLbv

    Score
    8/10
    bootkitdiscoverypersistenceransomware

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks