Resubmissions
29-11-2024 15:57
241129-td12ysylek 10General
-
Target
lsass.exe
-
Size
2.3MB
-
Sample
241129-td12ysylek
-
MD5
131f1e70e37f54ca486f111b596ea4ce
-
SHA1
b460653cb8a5294711d70a6a240100fbbb475b30
-
SHA256
c09333024c035b820003b8af59cbba362bfcdc5e2308fc8027dca324e0666c2c
-
SHA512
128b4e0946e1cc0227bb21a385a8df9ced6e12235fac99a506ec7e18c63806dc6e429eab6f21b971217433d68b8efc19f8c0006a5d53126fe21673ad9254caf5
-
SSDEEP
49152:wgwRAifu1DBgutBPNN52/N+0MgrMPR9JZqoUGKv1dHNUv+/C:wgwRAvguPPFeNvuRZqfD1l8L
Static task
static1
Behavioral task
behavioral1
Sample
lsass.exe
Resource
win11-20241007-de
Malware Config
Extracted
C:\Users\Admin\AppData\Local\How-to-decrypt.txt
http://pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion/
https://tox.chat/download.html
https://github.com/qTox/qTox/releases/download/v1.17.3/setup-qtox-x86_64-release.exe
Targets
-
-
Target
lsass.exe
-
Size
2.3MB
-
MD5
131f1e70e37f54ca486f111b596ea4ce
-
SHA1
b460653cb8a5294711d70a6a240100fbbb475b30
-
SHA256
c09333024c035b820003b8af59cbba362bfcdc5e2308fc8027dca324e0666c2c
-
SHA512
128b4e0946e1cc0227bb21a385a8df9ced6e12235fac99a506ec7e18c63806dc6e429eab6f21b971217433d68b8efc19f8c0006a5d53126fe21673ad9254caf5
-
SSDEEP
49152:wgwRAifu1DBgutBPNN52/N+0MgrMPR9JZqoUGKv1dHNUv+/C:wgwRAvguPPFeNvuRZqfD1l8L
-
Detects Mimic ransomware
-
Mimic family
-
Clears Windows event logs
-
Modifies boot configuration data using bcdedit
-
Renames multiple (187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2Clear Windows Event Logs
1File Deletion
1Modify Registry
4