General
- Target citizensinspace.org_ransome.exe
- Size 39KB
- Sample260509-kysrmsg13p
- SHA256 d3f768825305ab823d719bf5394275ecc6d241bcd7389d70595d6742f10763d6
Malware Config
Targets
-
- Target citizensinspace.org_ransome.exe
- Size 39KB
- SHA256 d3f768825305ab823d719bf5394275ecc6d241bcd7389d70595d6742f10763d6
Score10/10-
Family: NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Modifies Windows Firewall
-
Drops startup file
-
Stops running service(s)
-
Adds Run key to start application
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
1