Overview

overview

10

Static

static

10

2026-05-16...m_.exe

windows10-2004-x64

9

2026-05-16...m_.exe

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat
  • Size 868KB
  • Sample260517-afkm7sax71
  • SHA256 35e2b6e0dd05284e292dd79831f9f8641911c85141b27f96b545cbeade525804
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomware

Malware Config

Targets

    • Target
      2026-05-16_2018c00cd7560e2369452979c72c351e_amadey_avoslocker_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_medusalocker_njrat
    • Size 868KB
    • SHA256 35e2b6e0dd05284e292dd79831f9f8641911c85141b27f96b545cbeade525804
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryevasionexecutionpersistenceransomware

    • Clears Windows event logs

      defense_evasionransomware

    • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

    • Detects command variations typically used by ransomware

    • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

    • Detects executables containing commands for clearing Windows Event Logs

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (464) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Power Settings

1
T1653

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Indicator Removal

2
T1070

Clear Windows Event Logs

1
T1070.001

File Deletion

1
T1070.004

Modify Registry

3
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2
T1490

Tasks