General
-
Target
ENC_default_default_2024-08-23_22-53-04Demetro9990cock.li.exe
-
Size
2.2MB
-
Sample
241112-zbf7na1ard
-
MD5
801c430414f434df6fc24a9891b3b118
-
SHA1
27301b1a6c2078f4eec06ec6f1f947f22a1598fc
-
SHA256
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68
-
SHA512
e2c5e42a09c235d89ceb298ed27815c5b922e547568111ae916032f5cb85d89b197080d6641cf697f2fa18e11aebe66bef1669dc2155e9a89bfeb5e05eff1c29
-
SSDEEP
49152:wgwRwifu1DBgutBPNcpwcjVpNMkCZZpsYpmwZ3hQ8cTEo8:wgwRwvguPP4wc3NMkCGGmugTEt
Static task
static1
Behavioral task
behavioral1
Sample
ENC_default_default_2024-08-23_22-53-04Demetro9990cock.li.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ENC_default_default_2024-08-23_22-53-04Demetro9990cock.li.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\README.txt
Extracted
C:\Users\Admin\AppData\Local\README.txt
Targets
-
-
Target
ENC_default_default_2024-08-23_22-53-04Demetro9990cock.li.exe
-
Size
2.2MB
-
MD5
801c430414f434df6fc24a9891b3b118
-
SHA1
27301b1a6c2078f4eec06ec6f1f947f22a1598fc
-
SHA256
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68
-
SHA512
e2c5e42a09c235d89ceb298ed27815c5b922e547568111ae916032f5cb85d89b197080d6641cf697f2fa18e11aebe66bef1669dc2155e9a89bfeb5e05eff1c29
-
SSDEEP
49152:wgwRwifu1DBgutBPNcpwcjVpNMkCZZpsYpmwZ3hQ8cTEo8:wgwRwvguPP4wc3NMkCGGmugTEt
-
Detects Mimic ransomware
-
Mimic family
-
Modifies boot configuration data using bcdedit
-
Renames multiple (9288) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1