General
-
Target
final.exe
-
Size
30.0MB
-
Sample
250121-kdjm8svpbt
-
MD5
840d2a68808811af6ae92d562b485dae
-
SHA1
95447226acbfa013868b3dc05c145765ce80b880
-
SHA256
2b6ea8b47efe3ed662dbd56d024f9e0fac0570758969d222420fcce29a9d2a3a
-
SHA512
0123a108e5c8bb73e2d213f2d12c782c3c207742090a624eb7377ad5a180083bf8150d86ad8b9d93f04fa8070516dd51b9707e43859debf0b0cc85d33fc4c938
-
SSDEEP
786432:fq9Yidhz2W8A1YEA8o1QtIYa8DZcUTOl8fPGdO+TKPHmEakjN06tcDIR:fq9JaWfuskiIp61Hj+TOHhakJ06tB
Behavioral task
behavioral1
Sample
final.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
final.exe
-
Size
30.0MB
-
MD5
840d2a68808811af6ae92d562b485dae
-
SHA1
95447226acbfa013868b3dc05c145765ce80b880
-
SHA256
2b6ea8b47efe3ed662dbd56d024f9e0fac0570758969d222420fcce29a9d2a3a
-
SHA512
0123a108e5c8bb73e2d213f2d12c782c3c207742090a624eb7377ad5a180083bf8150d86ad8b9d93f04fa8070516dd51b9707e43859debf0b0cc85d33fc4c938
-
SSDEEP
786432:fq9Yidhz2W8A1YEA8o1QtIYa8DZcUTOl8fPGdO+TKPHmEakjN06tcDIR:fq9JaWfuskiIp61Hj+TOHhakJ06tB
-
Modifies Windows Defender Real-time Protection settings
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Drops file in Drivers directory
-
Possible privilege escalation attempt
-
Drops startup file
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Modifies file permissions
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
2Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
3System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Wi-Fi Discovery
1