hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke[.]98[.]exe | Triage

Submit
Reports

Overview

overview

8

Static

static

1

URLScan

urlscan

https://github.com/D...

windows7-x64

3

https://github.com/D...

windows10-2004-x64

3

https://github.com/D...

windows10-ltsc 2021-x64

https://github.com/D...

windows11-21h2-x64

Resubmissions

10-11-2024 10:05

241110-l4p4davelh 8

10-11-2024 10:02

241110-l29p1avblm 8

09-11-2024 17:59

241109-wk7jesyhpe 8

09-11-2024 17:59

241109-wkxn8azalm 1

09-11-2024 17:25

241109-vzld3a1phm 10

09-11-2024 16:09

241109-tlvj5szqer 8

09-11-2024 15:54

241109-tcj22sxeja 10

09-11-2024 13:49

241109-q4qgcsvkew 8

09-11-2024 13:26

241109-qp2abatraz 10

Sharing

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
Sample

241109-wk7jesyhpe

Score

8^/10

bootkit defense_evasion discovery evasion persistence ransomware upx

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Resource

win7-20240729-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral3

Sample

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Resource

win10ltsc2021-20241023-en

discovery evasion persistence ransomware upx

windows10-ltsc 2021-x64

25 signatures

150 seconds

Behavioral task

behavioral4

Sample

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Resource

win11-20241007-en

bootkit defense_evasion discovery persistence upx

windows11-21h2-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
Score

8^/10

discovery evasion persistence ransomware upx bootkit defense_evasion
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Pre-OS Boot

Bootkit

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

urlscan1

behavioral1

behavioral2

behavioral3

discoveryevasionpersistenceransomwareupx

behavioral4

bootkitdefense_evasiondiscoverypersistenceupx

© 2018-2024

Terms | Privacy