Overview

overview

9

Static

static

3

2tXPLxr.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    2tXPLxr.exe
  • Size 14.9MB
  • Sample260528-th3rcafv7s
  • SHA256 c5f9eafa1c5871343b7869711f0d796eede90fd4df60566c6e5ed3c6a464f183
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      2tXPLxr.exe
    • Size 14.9MB
    • SHA256 c5f9eafa1c5871343b7869711f0d796eede90fd4df60566c6e5ed3c6a464f183
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoverypersistenceprivilege_escalationransomware

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks