General
- Target SF-Verif.exe
- Size 667KB
- Sample260523-26dfcsfs5w
- SHA256 7c75a2d74fe4523dc28362f095482d9120cab1ffb7896947cc65eb950eaee05c
- MD5 c029e9b4699b1277cdac62df58012e0f
- SHA1 eb3a86d98ebe4d63f4917a07bd671602ea451403
- SHA512 ae8665c034fa2cd25989cebfe795f64797db63464bda400b501ec6e24c795599e67c043bdba204b5e6281e8abb0427dcb651ec87670f01d5f3108930a24288b9
- SSDEEP 6144:bNp819f5K6Z7deV39iKthkmL23fzaVRhEoquBvO835VKLZrSumyaRth86cEcm:bGM07dQ9iItLMzuIuBd35VSsth83EH
- TLSH T11BE4087AF71219ADC05F037B85A587E195912685F334A5B702B48E53BAE34C24F3AFC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
SF-Verif.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
SF-Verif.exe
Resource
win11-20260513-en
Malware Config
Targets
-
- Target SF-Verif.exe
- Size 667KB
- SHA256 7c75a2d74fe4523dc28362f095482d9120cab1ffb7896947cc65eb950eaee05c
- MD5 c029e9b4699b1277cdac62df58012e0f
- SHA1 eb3a86d98ebe4d63f4917a07bd671602ea451403
- SHA512 ae8665c034fa2cd25989cebfe795f64797db63464bda400b501ec6e24c795599e67c043bdba204b5e6281e8abb0427dcb651ec87670f01d5f3108930a24288b9
- SSDEEP 6144:bNp819f5K6Z7deV39iKthkmL23fzaVRhEoquBvO835VKLZrSumyaRth86cEcm:bGM07dQ9iItLMzuIuBd35VSsth83EH
- TLSH T11BE4087AF71219ADC05F037B85A587E195912685F334A5B702B48E53BAE34C24F3AFC2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables service(s)
-
Modifies file permissions
-
Stops running service(s)
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
MITRE ATT&CK Enterprise v16
Execution
System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Indicator Removal
4Clear Persistence
1File Deletion
3Modify Registry
1Pre-OS Boot
1Bootkit
1