hxxps://chomikuj[.]pl/action/redirect?url=https%3A%2F%2Ftinyurl[.]com%2Fyckumn8z&token=26384e27c6a72ff6ba2f3352ec900003fbf00f46

General

Target
https://chomikuj.pl/action/redirect?url=https%3A%2F%2Ftinyurl.com%2Fyckumn8z&token=26384e27c6a72ff6ba2f3352ec900003fbf00f46
Sample260511-xr6fdacv4k

Score

10^/10

Malware Config

Targets

- Target
  https://chomikuj.pl/action/redirect?url=https%3A%2F%2Ftinyurl.com%2Fyckumn8z&token=26384e27c6a72ff6ba2f3352ec900003fbf00f46
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1