efde83060278f1f8ae95c8ce4d8d1c51bc84012c0c579a354f1562acf4d1ee7b | Triage

Sharing

General

Target

sample
Size

19KB
Sample

241122-x5gzyasqdm
MD5

87529e569e8dbe7595a2b2d9c96514fd
SHA1

06083b416ea4da42dd67fc1b03e6f17e477b8fe3
SHA256

efde83060278f1f8ae95c8ce4d8d1c51bc84012c0c579a354f1562acf4d1ee7b
SHA512

2a58f1be9522bf7c53e87994ebd40e93dbc5d8cc8eb60eaf4eb94b88d1aa95665eea4e180108a2b35c86e48f103ca9240931c7ea3b79b5e85cdf02fe727cc2c6
SSDEEP

384:Y7G71ocy404lbGaxMvhpNjcBRcG5ClObz6r0sZmfk1xCejiw:Yo1ocy4LEamJpNYBxJbz6r0sZEexPiw

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  sample
- Size
  
  19KB
- MD5
  
  87529e569e8dbe7595a2b2d9c96514fd
- SHA1
  
  06083b416ea4da42dd67fc1b03e6f17e477b8fe3
- SHA256
  
  efde83060278f1f8ae95c8ce4d8d1c51bc84012c0c579a354f1562acf4d1ee7b
- SHA512
  
  2a58f1be9522bf7c53e87994ebd40e93dbc5d8cc8eb60eaf4eb94b88d1aa95665eea4e180108a2b35c86e48f103ca9240931c7ea3b79b5e85cdf02fe727cc2c6
- SSDEEP
  
  384:Y7G71ocy404lbGaxMvhpNjcBRcG5ClObz6r0sZmfk1xCejiw:Yo1ocy4LEamJpNYBxJbz6r0sZEexPiw
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan