General
- Target fakecry.exe
- Size 36.7MB
- Sample260713-ws2cdaft51
- SHA256 1e7ccec9091ca08281bea6c9d721082e19e5c5126b675232fc2b3f455418a3da
Score
10/10
Malware Config
Targets
-
- Target fakecry.exe
- Size 36.7MB
- SHA256 1e7ccec9091ca08281bea6c9d721082e19e5c5126b675232fc2b3f455418a3da
Score10/10-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Modifies Windows Firewall
-
Disables service(s)
-
Loads dropped DLL
-
Stops running service(s)
-
Adds Run key to start application
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1