General
- Target nukewin.exe
- Size 2.8MB
- Sample250503-mefdbagq4y
- SHA256 61bf83fca05e85810e2dcaaf798990e7509dd7d1d386b5a263011da655c20961
Score
10/10
Malware Config
Targets
-
- Target nukewin.exe
- Size 2.8MB
- SHA256 61bf83fca05e85810e2dcaaf798990e7509dd7d1d386b5a263011da655c20961
Score10/10-
Modifies security service
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1