General
- Target Rangerv0.jar
- Size 49.4MB
- Sample260427-a56a7sdw7l
- SHA256 09b8b7722e49b20bc4b05bbd078ccfbc66f9206bad57943ac0746cde3c5d309a
Malware Config
Targets
-
- Target Rangerv0.jar
- Size 49.4MB
- SHA256 09b8b7722e49b20bc4b05bbd078ccfbc66f9206bad57943ac0746cde3c5d309a
Score10/10Family: CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2