d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

Target

test.txt
Size

18B
Sample

250218-ttqadstlfr
MD5

5b3f97d48c8751bd031b7ea53545bdb6
SHA1

88be3374c62f23406ec83bb11279f8423bd3f88d
SHA256

d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
SHA512

ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

Score

10^/10

Malware Config

Targets

- Target
  
  test.txt
- Size
  
  18B
- MD5
  
  5b3f97d48c8751bd031b7ea53545bdb6
- SHA1
  
  88be3374c62f23406ec83bb11279f8423bd3f88d
- SHA256
  
  d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b
- SHA512
  
  ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan
- Disables service(s)
  defense_evasion execution
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Indicator Removal: Network Share Connection Removal
  Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- Legitimate hosting services abused for malware hosting/C2
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral1