General
-
Target
final.exe
-
Size
29.8MB
-
Sample
250120-m4ajcswjhw
-
MD5
c37a016ef7be22332932092d8b13584d
-
SHA1
2e2a911955d36e05d90f424aa86b30067607b899
-
SHA256
161289c083efd8410446f0b4ac7c547dd79f8e54cc4c92c3b64851ce3e731e81
-
SHA512
38994e8926aeaaf60fe43cfca1a91fa56ecd8a8adc295d0082ccef120658f32fe4d224ae433e553658233e4e6c2da32710821e0f361387c42a9f537d8842c0f6
-
SSDEEP
786432:hl9Yidhz2W8A1YEA8o1QtIYa8DZcUTOl8ffGdO+FPHmEakdN0UcDIE:n9JaWfuskiIp61HD+tHhak30UB
Behavioral task
behavioral1
Sample
final.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
final.exe
-
Size
29.8MB
-
MD5
c37a016ef7be22332932092d8b13584d
-
SHA1
2e2a911955d36e05d90f424aa86b30067607b899
-
SHA256
161289c083efd8410446f0b4ac7c547dd79f8e54cc4c92c3b64851ce3e731e81
-
SHA512
38994e8926aeaaf60fe43cfca1a91fa56ecd8a8adc295d0082ccef120658f32fe4d224ae433e553658233e4e6c2da32710821e0f361387c42a9f537d8842c0f6
-
SSDEEP
786432:hl9Yidhz2W8A1YEA8o1QtIYa8DZcUTOl8ffGdO+FPHmEakdN0UcDIE:n9JaWfuskiIp61HD+tHhak30UB
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Drops file in Drivers directory
-
Possible privilege escalation attempt
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Accessibility Features
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Accessibility Features
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
2Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1