General
-
Target
final.exe
-
Size
29.9MB
-
Sample
250119-my1tcsvpbr
-
MD5
2fa5aa0c6e5966b5fa507f64505dd51b
-
SHA1
0cd981b8c17e34bf0c12a3a44f5b3b68d15d1fd2
-
SHA256
2b6644ae20797630429de215fd7ba64bb83c5845e799b265e6351a8bde49c0c3
-
SHA512
986d21bff3cbde981eb00030d1f8b6479573ee833de1c3a4937d2333442ee61c6f8cd7d7092b92efc14c5090421e8a727a42c035332acd4333d9cd1c1ebb13ad
-
SSDEEP
786432:E9Yidhz2W8A1YEA8o1QtIYa8DZcUTOl8f2GdO+SPHmEakZXCu0UcDIj:E9JaWfuskiIp61Ho+WHhak5Cu0UB
Behavioral task
behavioral1
Sample
final.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
final.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
final.exe
-
Size
29.9MB
-
MD5
2fa5aa0c6e5966b5fa507f64505dd51b
-
SHA1
0cd981b8c17e34bf0c12a3a44f5b3b68d15d1fd2
-
SHA256
2b6644ae20797630429de215fd7ba64bb83c5845e799b265e6351a8bde49c0c3
-
SHA512
986d21bff3cbde981eb00030d1f8b6479573ee833de1c3a4937d2333442ee61c6f8cd7d7092b92efc14c5090421e8a727a42c035332acd4333d9cd1c1ebb13ad
-
SSDEEP
786432:E9Yidhz2W8A1YEA8o1QtIYa8DZcUTOl8f2GdO+SPHmEakZXCu0UcDIj:E9JaWfuskiIp61Ho+WHhak5Cu0UB
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Drops file in Drivers directory
-
Possible privilege escalation attempt
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
2Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
4Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1