General
- Target WindowsFormsApp15.exe
- Size 2.6MB
- Sample260701-13rm5sfs4m
- SHA256 39e45d925387ce458d7f3155a90ae40dc4d32962b9d150b6a17278428ab38999
Malware Config
Targets
-
- Target WindowsFormsApp15.exe
- Size 2.6MB
- SHA256 39e45d925387ce458d7f3155a90ae40dc4d32962b9d150b6a17278428ab38999
Score10/10-
Modifies WinLogon for persistence
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Adds policy Run key to start application
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Disables service(s)
-
Executes dropped EXE
-
Modifies file permissions
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1