General
- Target b6743906c49c1c7a36439a46de9aca88b6cd40f52af128b215f808a406a69598
- Size 1.4MB
- Sample260212-rqbxgset3c
- SHA256 b6743906c49c1c7a36439a46de9aca88b6cd40f52af128b215f808a406a69598
Score
10/10
Malware Config
Targets
-
- Target b6743906c49c1c7a36439a46de9aca88b6cd40f52af128b215f808a406a69598
- Size 1.4MB
- SHA256 b6743906c49c1c7a36439a46de9aca88b6cd40f52af128b215f808a406a69598
Score10/10AESRT
AESRT is a ransomware.
Aesrt family
Modifies WinLogon for persistence
UAC bypass
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Renames multiple (123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
Disables Task Manager via registry modification
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Checks whether UAC is enabled
Drops desktop.ini file(s)
Modifies WinLogon
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
5