45d06c613d889907a8d9f6d948b12f71dd8dea379f939d9b154224b719881b1c | Triage

Sharing

General

Target

YourWindowsWillDieifyourunthisasadmin.exe
Size

708KB
Sample

240927-t5w73s1hjq
MD5

0f8edf1073f6d851d555b8d754510cbf
SHA1

e3b8915fd860302843fccc40bf96a13b91bb7066
SHA256

45d06c613d889907a8d9f6d948b12f71dd8dea379f939d9b154224b719881b1c
SHA512

f695b95a2f521bc70eeb6424a567d2117a4a9a925b83d676e047ed55e59a7464414ef5ddfc09880a3cef02365b8e05bf2529e37b768dec8d270485b0e5f13b19
SSDEEP

12288:IU+9H3900EJqrekLEyTYQcDL/TNuUCziP6VFGO5lrEaKYNtcBvAuvlee2NCFbLk4:IU+9XNrenyktDLdYNtcdvQNC9wHAP5cI

Score

10^/10

credential_access defense_evasion discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Targets

- Target
  
  YourWindowsWillDieifyourunthisasadmin.exe
- Size
  
  708KB
- MD5
  
  0f8edf1073f6d851d555b8d754510cbf
- SHA1
  
  e3b8915fd860302843fccc40bf96a13b91bb7066
- SHA256
  
  45d06c613d889907a8d9f6d948b12f71dd8dea379f939d9b154224b719881b1c
- SHA512
  
  f695b95a2f521bc70eeb6424a567d2117a4a9a925b83d676e047ed55e59a7464414ef5ddfc09880a3cef02365b8e05bf2529e37b768dec8d270485b0e5f13b19
- SSDEEP
  
  12288:IU+9H3900EJqrekLEyTYQcDL/TNuUCziP6VFGO5lrEaKYNtcBvAuvlee2NCFbLk4:IU+9XNrenyktDLdYNtcdvQNC9wHAP5cI
Score

10^/10

credential_access defense_evasion discovery evasion persistence ransomware spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks whether UAC is enabled
  evasion trojan
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Safe Mode Boot

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

credential_accessdefense_evasiondiscoveryevasionpersistenceransomwarespywarestealertrojan