21a96bfc176b040742633ed18fc5cbf4e6e7d6ec1c413db291b9ae45089c5d3a

General

Target
mxbc.zip
Size 12.7MB
Sample241114-rtjfqs1bmk
SHA256 21a96bfc176b040742633ed18fc5cbf4e6e7d6ec1c413db291b9ae45089c5d3a
MD5 27e3344b8fdbe9bbc83fc8700183dc08
SHA1 920ebc6d698c53696f7f87862c730254836d06f2
SHA512 16e8516d59935ed80184bf12daa6b2ff22d4620db8c00be2ea289dae9b3eb73b98ccbe4203eb307596b0cb39720b059bff57c6d778e932a30498c8b08caefbbc
SSDEEP 393216:E8JemlYSh0IqQOIs51/+NS17ttJ/p8g17GjD:E8JPaSh0IqQOjIS1Bp8g1ID
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  mxbc.exe
- Size 12.9MB
- SHA256 47e71e46140def04f30978aabc76717a14e614be2c9821dab3519a393e8a84c0
- MD5 255417900bdc1c321a01573e3747e8b8
- SHA1 ab197f928fcaea52066e688f139f72dc2d0b5df8
- SHA512 fc9801564280b7833098de3afc55cd26acbca85b82a8606b91f9a91970c7173a687998187e8b25c3ee597ecd45cd7848e6e0c7968e4c970ab4bfc7e6b80eabcd
- SSDEEP 393216:ocyi/u42UPzS1/54Jqz95NL2kyZMILp4OV:Ju5UPWO4omINd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

bootkit defense_evasion discovery evasion exploit persistence ransomware upx
- Modifies WinLogon for persistence
  persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Indicator Removal: Network Share Connection Removal
  Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Modifies boot configuration data using bcdedit
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2