Overview

overview

10

Static

static

3

MovieDuels.x86.exe

windows11-21h2-x64

Resubmissions

30/03/2025, 21:06

250330-zx7lqsxsaz 10

30/03/2025, 21:02

250330-zvd7eayrv4 8

30/03/2025, 20:49

250330-zmf12awyh1 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MovieDuels.x86.exe

  • Size

    830KB

  • Sample

    250330-zmf12awyh1

  • MD5

    e0f676512de7503cf559cb1e5212e7e7

  • SHA1

    6a19ca3de64e3d3e16d160d9b3f10a9019302660

  • SHA256

    2b6d4cefa77ae47c33bbad9dba1dbce9f83a83ed31a0fc5039d24b2c649a7dca

  • SHA512

    b31185e3a5af2421382d56b82c7329c092a5287005be3667638acb7c2ccaabe5a89c10695ccac97406e72bc1d52ac6865e9b0a84437875d8abe35f65d5fb60fa

  • SSDEEP

    24576:hHKxoUWVvBO9Pw0JivckQxgiKZj3z4wBpdwV9RNdJB5nS3T4+LX:hqxnivmAj3z4wBpiSTRz

Score
10/10
defense_evasiondiscoverypersistenceransomwaretrojan

Malware Config

Targets

    • Target

      MovieDuels.x86.exe

    • Size

      830KB

    • MD5

      e0f676512de7503cf559cb1e5212e7e7

    • SHA1

      6a19ca3de64e3d3e16d160d9b3f10a9019302660

    • SHA256

      2b6d4cefa77ae47c33bbad9dba1dbce9f83a83ed31a0fc5039d24b2c649a7dca

    • SHA512

      b31185e3a5af2421382d56b82c7329c092a5287005be3667638acb7c2ccaabe5a89c10695ccac97406e72bc1d52ac6865e9b0a84437875d8abe35f65d5fb60fa

    • SSDEEP

      24576:hHKxoUWVvBO9Pw0JivckQxgiKZj3z4wBpdwV9RNdJB5nS3T4+LX:hqxnivmAj3z4wBpiSTRz

    Score
    10/10
    defense_evasiondiscoverypersistenceransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      defense_evasiontrojan

    • Disables RegEdit via registry modification

      defense_evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Tasks