284458fecde8fd530b4a61d80c452424b720e05c04dd3fbb49b7e0f6b32754c3 | Triage

Sharing

General

Target

sample
Size

19KB
Sample

241121-wabzrstraz
MD5

ff923acc27e39737241eb55c857cc1d5
SHA1

78b579972644ec67de3bab5c274e9cf5a14721a7
SHA256

284458fecde8fd530b4a61d80c452424b720e05c04dd3fbb49b7e0f6b32754c3
SHA512

04f9820278f028d1139195b649bb02f28d91d6cf221b3295d7b6761cc8eb6a4eb12f456cdf81d13e9d46dba7b8e24eaa33c671550a409eddc7de337d68af0089
SSDEEP

384:rjhpH1ocy4w4lbGaUPOvhpNO9+hGERlObz6r0sZTL2fH1xCejiw:rjrH1ocy4fEaSOJpNe+8bz6r0sZTLUVn

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  sample
- Size
  
  19KB
- MD5
  
  ff923acc27e39737241eb55c857cc1d5
- SHA1
  
  78b579972644ec67de3bab5c274e9cf5a14721a7
- SHA256
  
  284458fecde8fd530b4a61d80c452424b720e05c04dd3fbb49b7e0f6b32754c3
- SHA512
  
  04f9820278f028d1139195b649bb02f28d91d6cf221b3295d7b6761cc8eb6a4eb12f456cdf81d13e9d46dba7b8e24eaa33c671550a409eddc7de337d68af0089
- SSDEEP
  
  384:rjhpH1ocy4w4lbGaUPOvhpNO9+hGERlObz6r0sZTL2fH1xCejiw:rjrH1ocy4fEaSOJpNe+8bz6r0sZTLUVn
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

behavioral2

discoveryevasionpersistenceransomwaretrojan