Resubmissions

31-10-2024 08:45

241031-kn28bsvgnj 1

31-10-2024 08:39

241031-kkgr8avgkn 1

31-10-2024 08:31

241031-ke7rfssrhx 10

31-10-2024 08:31

241031-kep7easrgs 1

31-10-2024 08:28

241031-kc6rdasrcx 10

31-10-2024 08:25

241031-kbss5asrat 10

31-10-2024 08:25

241031-kbcf5svepk 1

31-10-2024 08:22

241031-j9qkzsveln 10

31-10-2024 08:15

241031-j5n7cswlbp 10

General

  • Target

    LCrypt0rX.vbs

  • Size

    22KB

  • Sample

    241031-kc6rdasrcx

  • MD5

    f25a640ad8b8ea3b0f63ae8959c129a1

  • SHA1

    eadb43ef97823955f8b30a4e621e5422f8894afe

  • SHA256

    3b39fb55fdfa391dc03c40197b88165c18a260bf9b171a46622c9304c7c38d53

  • SHA512

    6964a4b78972d0fc0be9bebd2a3752a63b261281920f1b0bac2f9c9fb7215a268b2cb3258975f417df5e790c9c89da4f9ec8015f7e57b1cf0b58d2298249c524

  • SSDEEP

    384:t0GbplStxYHQHSH7l+i/HVn2jv1QayXwA+sxQ+E6O:LJR2iY+EF

Malware Config

Targets

    • Target

      LCrypt0rX.vbs

    • Size

      22KB

    • MD5

      f25a640ad8b8ea3b0f63ae8959c129a1

    • SHA1

      eadb43ef97823955f8b30a4e621e5422f8894afe

    • SHA256

      3b39fb55fdfa391dc03c40197b88165c18a260bf9b171a46622c9304c7c38d53

    • SHA512

      6964a4b78972d0fc0be9bebd2a3752a63b261281920f1b0bac2f9c9fb7215a268b2cb3258975f417df5e790c9c89da4f9ec8015f7e57b1cf0b58d2298249c524

    • SSDEEP

      384:t0GbplStxYHQHSH7l+i/HVn2jv1QayXwA+sxQ+E6O:LJR2iY+EF

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Blocklisted process makes network request

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Disables RegEdit via registry modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks