Overview

overview

9

Static

static

3

postinstall.exe

windows7-x64

Resubmissions

09/10/2024, 17:46

241009-wch6vszgpk9

09/10/2024, 17:34

241009-v5l8jsvarc9

Sharing

Copy URL Twitter E-mail

General

  • Target
    postinstall.exe
  • Size 78KB
  • Sample241009-wch6vszgpk
  • SHA256 d8f1a8ac9b5e70f9c45bdfaadbebf58531d1b9a3377e05d53a03f34c15503170
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
defense_evasionevasionexecutionpersistenceransomware

Malware Config

Targets

    • Target
      postinstall.exe
    • Size 78KB
    • SHA256 d8f1a8ac9b5e70f9c45bdfaadbebf58531d1b9a3377e05d53a03f34c15503170
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasionevasionexecutionpersistenceransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Stops running service(s)

      evasionexecution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence

    • System Binary Proxy Execution: Verclsid

      Adversaries may abuse Verclsid to proxy execution of malicious code.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks