General
- Target Antivirus-Yorik_Nedohackers.exe
- Size 9.7MB
- Sample260701-vt8bmsa16l
- SHA256 3aadfec55674f532444f51da33fb9d10db579b20822c2709c9ac12eeb11d4af5
Score
9/10
Malware Config
Targets
-
- Target Antivirus-Yorik_Nedohackers.exe
- Size 9.7MB
- SHA256 3aadfec55674f532444f51da33fb9d10db579b20822c2709c9ac12eeb11d4af5
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Stops running service(s)
-
Adds Run key to start application
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2