General
- Target NBB.exe
- Size 145KB
- Sample260507-mdfmpabw21
- SHA256 59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d
Score
9/10
Malware Config
Targets
-
- Target NBB.exe
- Size 145KB
- SHA256 59dd29982f9644046b726452978de2dbed11d12c4c5a7eb22e4ad52d7951c16d
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Enumerates processes with tasklist
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1