Overview

overview

10

Static

static

1

sample.js

windows11-21h2-x64

Resubmissions

04/11/2024, 20:55

241104-zqy11sxbqe8

04/11/2024, 20:52

241104-znv7caxbmc10

04/11/2024, 20:32

241104-zbrcmaxclp8

04/11/2024, 20:28

241104-y9ek2swgrf8

Sharing

Copy URL Twitter E-mail

General

  • Target
    sample
  • Size 66KB
  • Sample241104-znv7caxbmc
  • SHA256 7909ad298eba1b0e68c4e7a905563960e39bf5fdc324663e91dc9bf1af7e4565
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoveryevasionexecutionpersistenceransomwaretrojan

Malware Config

Targets

    • Target
      sample
    • Size 66KB
    • SHA256 7909ad298eba1b0e68c4e7a905563960e39bf5fdc324663e91dc9bf1af7e4565
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionexecutionpersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks