c987ef43cf5423d65f71ac48cae736bfa419d194da02487178e618e922be995f | Triage

Sharing

General

Target

account_convert_icon_136995.ico
Size

66KB
Sample

240920-rfmk8szgmf
MD5

1836b6b594dc60611a302d99fe4d6f7d
SHA1

0a5b0ae5d3608ca46217d59f4d5f0bae18b28cd0
SHA256

c987ef43cf5423d65f71ac48cae736bfa419d194da02487178e618e922be995f
SHA512

c4232cd1444a7cd228e13a63413a095201f8001ae5809e39ab6e68862a5d553c555c8cf3fbae3a7615a28c87eaa906524a71fe5ceca76f8b4690dabbd8841703
SSDEEP

192:PE7JdVvSiWqvlOGoovynE4gnl4QK6RdqiK1gjN:PE7JdlSiWqdQovynE4glQ6GsN

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  account_convert_icon_136995.ico
- Size
  
  66KB
- MD5
  
  1836b6b594dc60611a302d99fe4d6f7d
- SHA1
  
  0a5b0ae5d3608ca46217d59f4d5f0bae18b28cd0
- SHA256
  
  c987ef43cf5423d65f71ac48cae736bfa419d194da02487178e618e922be995f
- SHA512
  
  c4232cd1444a7cd228e13a63413a095201f8001ae5809e39ab6e68862a5d553c555c8cf3fbae3a7615a28c87eaa906524a71fe5ceca76f8b4690dabbd8841703
- SSDEEP
  
  192:PE7JdVvSiWqvlOGoovynE4gnl4QK6RdqiK1gjN:PE7JdlSiWqdQovynE4glQ6GsN
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan

behavioral2