General
- Target Osint.rar
- Size 9.7MB
- Sample260603-2lfd8af19k
- SHA256 9df0774ea9ee24a06c07f8db839b0992023a61f4bfd6c1eaba555597b71edf21
Score
10/10
Malware Config
Targets
-
- Target OpenSourceEye/main.exe
- Size 10.0MB
- SHA256 746aec43970370cdd845c9a9b62cb23559e4d01889854f7f05daa56a53430fd9
Score10/10-
Modifies WinLogon for persistence
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Creates new service(s)
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Stops running service(s)
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Hide Artifacts: Hidden Files and Directories
-
- Target 321.pyc
- Size 40KB
- SHA256 bd74db1c948d40da37fcd248067ed62d89bbe1933ec1273dab0e1b97d7a2ae5a
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1