General
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo/
-
Sample
241026-knbelsznbr
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Da2dalus/The-MALWARE-Repo/
Resource
win7-20240903-en
Malware Config
Extracted
F:\$RECYCLE.BIN\BEGIAXZBR-MANUAL.txt
gandcrab
http://gandcrabmfe6mnef.onion/37aff50a56c30f97
Extracted
C:\g6QpgrhJDdQZeF0\DECRYPT_YOUR_FILES.HTML
Targets
-
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo/
-
Fantom family
-
Gandcrab family
-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
Infinitylock family
-
Renames multiple (330) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Sets service image path in registry
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies WinLogon
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
6Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1