Overview

overview

10

Static

static

1

ядерка.bat

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ядерка.bat
  • Size 1KB
  • Sample260624-2ry4hsgs4r
  • SHA256 718cf3cd7a5706159ac1fe1d220ab7408791903623be0a7d0f0891ab3cdd0e81
  • MD5 SHA1 SHA512 TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionexploitimpactpersistenceransomware

Malware Config

Targets

    • Target
      ядерка.bat
    • Size 1KB
    • SHA256 718cf3cd7a5706159ac1fe1d220ab7408791903623be0a7d0f0891ab3cdd0e81
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionexploitimpactpersistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Possible privilege escalation attempt

      exploit

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks