Overview

overview

8

Static

static

5

Trojan.Ran...1).exe

windows10-ltsc_2021-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    Trojan.Ransom.Covid-666 (1).exe
  • Size 687KB
  • Sample260707-khtc8sa15q
  • SHA256 1eefaeb98524277d1aeb459b6e4a31472ce2f4ff15f8f45b051e1c8a021c8fa7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitdefense_evasiondiscoverypersistenceransomwareupx

Malware Config

Targets

    • Target
      Trojan.Ransom.Covid-666 (1).exe
    • Size 687KB
    • SHA256 1eefaeb98524277d1aeb459b6e4a31472ce2f4ff15f8f45b051e1c8a021c8fa7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    bootkitdefense_evasiondiscoverypersistenceransomwareupx

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Sets desktop wallpaper using registry

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks