ploutus | 6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f | Triage

Sharing

General

Target

6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f
Size

54KB
Sample

241121-bwmceaxnc1
MD5

c0c56f310160cb211e7e69fdf24bee43
SHA1

6279cf3d1e370444950b2c694f16e3bd7c8ec969
SHA256

6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f
SHA512

28402f4a022a0d0172ea0547011e9f344f687259f94f857a2250e916f3e83095f46d4f199fb112a10cdca7126f7cf640571595b301ef0e9e374ed067577cf572
SSDEEP

768:U+hvPV2e5loa5VIz3+hNbPQNg6OHPSnGoVrtqkql6bcIwC9t+St+:vkoi3+vPQNg6OHPCGyRq56b3hU

Score

10^/10

ploutus defense_evasion discovery evasion persistence ransomware

Malware Config

Targets

- Target
  
  6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f
- Size
  
  54KB
- MD5
  
  c0c56f310160cb211e7e69fdf24bee43
- SHA1
  
  6279cf3d1e370444950b2c694f16e3bd7c8ec969
- SHA256
  
  6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f
- SHA512
  
  28402f4a022a0d0172ea0547011e9f344f687259f94f857a2250e916f3e83095f46d4f199fb112a10cdca7126f7cf640571595b301ef0e9e374ed067577cf572
- SSDEEP
  
  768:U+hvPV2e5loa5VIz3+hNbPQNg6OHPSnGoVrtqkql6bcIwC9t+St+:vkoi3+vPQNg6OHPCGyRq56b3hU
Score

9^/10

defense_evasion discovery evasion persistence ransomware
- Clears Windows event logs
  evasion ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

Privilege Escalation

Defense Evasion

Indicator Removal

Clear Windows Event Logs

File Deletion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionpersistenceransomware

behavioral2

defense_evasiondiscoveryevasionpersistenceransomware