General
- Target FadeSEC_test.exe
- Size 729KB
- Sample260722-xep8maysdv
- SHA256 30cec59bb3ba41ad7a6ce8c1ca4fe98231ee84e214182772289b2353f7417849
Score
9/10
Malware Config
Targets
-
- Target FadeSEC_test.exe
- Size 729KB
- SHA256 30cec59bb3ba41ad7a6ce8c1ca4fe98231ee84e214182772289b2353f7417849
Score9/10Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Enumerates VirtualBox registry keys
Modifies boot configuration data using bcdedit
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
Looks for VMWare services registry key.
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2