ae5dc430f838f013f856fac054c9d267e85d0d75a93bbbf477f6745d935bfb16 | Triage

Sharing

General

Target

fucked.exe
Size

8.4MB
Sample

250326-xr3dqasry3
MD5

b363136de32053846c3555ba49df6cb6
SHA1

3b72b51dce822bb2d6bcccf55826fc4943dffd59
SHA256

ae5dc430f838f013f856fac054c9d267e85d0d75a93bbbf477f6745d935bfb16
SHA512

dcc40f6192c4b815e6603d3fb24c694a1db9a9b3357744b9db03341c2088c716d16d5117495a5f9ceb9094f9242b4c5a29b0dab1f9567aee33d641cd66f5a876
SSDEEP

196608:94jP+u0XMCHGLLc54i1wN+wV0cSXl74w4iX/O2yqsP8gT8NlOnAJ:ijWu0XMCHWUjYVg74wtNVsGJ

Score

9^/10

discovery evasion exploit persistence pyinstaller ransomware

Malware Config

Targets

- Target
  
  fucked.exe
- Size
  
  8.4MB
- MD5
  
  b363136de32053846c3555ba49df6cb6
- SHA1
  
  3b72b51dce822bb2d6bcccf55826fc4943dffd59
- SHA256
  
  ae5dc430f838f013f856fac054c9d267e85d0d75a93bbbf477f6745d935bfb16
- SHA512
  
  dcc40f6192c4b815e6603d3fb24c694a1db9a9b3357744b9db03341c2088c716d16d5117495a5f9ceb9094f9242b4c5a29b0dab1f9567aee33d641cd66f5a876
- SSDEEP
  
  196608:94jP+u0XMCHGLLc54i1wN+wV0cSXl74w4iX/O2yqsP8gT8NlOnAJ:ijWu0XMCHWUjYVg74wtNVsGJ
Score

9^/10

discovery evasion exploit persistence ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

discoveryevasionexploitpersistenceransomware