7690e785a0e17bb22a778afd21610bfe2e62a2f5d2a93e0d6b3ddab9f266437c | Triage

Resubmissions

27-11-2024 19:00

241127-xnsp4sskfl 7

27-11-2024 18:32

241127-w6v3hs1mfm 10

27-11-2024 18:26

241127-w3b58svlcx 10

Sharing

General

Target

PythonPcCrasher.py
Size

2KB
Sample

241127-w3b58svlcx
MD5

d24850b91f327ff7c4964f977f947765
SHA1

8484e62f2c6fbae5f6209b925628765c389610f5
SHA256

7690e785a0e17bb22a778afd21610bfe2e62a2f5d2a93e0d6b3ddab9f266437c
SHA512

bbdef8da1c04e13a16cad90231abcc1917af5b7e4310e08800f935b4973b61a815f85bf65442601cfdfeb15b0f584128f05b3966842e53b117f9e066f06746b7

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  PythonPcCrasher.py
- Size
  
  2KB
- MD5
  
  d24850b91f327ff7c4964f977f947765
- SHA1
  
  8484e62f2c6fbae5f6209b925628765c389610f5
- SHA256
  
  7690e785a0e17bb22a778afd21610bfe2e62a2f5d2a93e0d6b3ddab9f266437c
- SHA512
  
  bbdef8da1c04e13a16cad90231abcc1917af5b7e4310e08800f935b4973b61a815f85bf65442601cfdfeb15b0f584128f05b3966842e53b117f9e066f06746b7
Score

10^/10

discovery evasion persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan