f26a4285c19d110ea7b26951b79528a4c3e18ee32e272d71a1d3690cefd133dd | Triage

Resubmissions

22/11/2024, 18:49

241122-xgngtawmfx 10

22/11/2024, 18:38

241122-xaj6tasjak 8

22/11/2024, 15:49

241122-s9rmqazlen 8

22/11/2024, 15:46

241122-s738qstmhx 8

Sharing

General

Target

sample
Size

19KB
Sample

241122-xgngtawmfx
MD5

d9f36e39a89710a3791fdda6716be364
SHA1

06856b45244948129e9f7bf56d544c3b9e4f2ebe
SHA256

f26a4285c19d110ea7b26951b79528a4c3e18ee32e272d71a1d3690cefd133dd
SHA512

621eb4ccbd8044910a00db6bb6e1d594dcbd1198a60b77c8e13a66d1ef34b97536094b9c58521c663670ff02b740e5223f1e17917811b0fcac6f42780a277575
SSDEEP

384:5gGl+1ocy4B4lbGa0MvhpNKtxMLltAlObz6r0sZrfx1xCejiw:5Q1ocy4qEaHJpNmxmlTbz6r0sZLfxPiw

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  sample
- Size
  
  19KB
- MD5
  
  d9f36e39a89710a3791fdda6716be364
- SHA1
  
  06856b45244948129e9f7bf56d544c3b9e4f2ebe
- SHA256
  
  f26a4285c19d110ea7b26951b79528a4c3e18ee32e272d71a1d3690cefd133dd
- SHA512
  
  621eb4ccbd8044910a00db6bb6e1d594dcbd1198a60b77c8e13a66d1ef34b97536094b9c58521c663670ff02b740e5223f1e17917811b0fcac6f42780a277575
- SSDEEP
  
  384:5gGl+1ocy4B4lbGa0MvhpNKtxMLltAlObz6r0sZrfx1xCejiw:5Q1ocy4qEaHJpNmxmlTbz6r0sZLfxPiw
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan