General
- Target FadeSEC_test.exe
- Size 729KB
- Sample260722-xy5gnabb98
- SHA256 358207c5a0d39b07331623d758b6431d84a17a8be821cd4388e323ab50f8a259
Score
9/10
Malware Config
Targets
-
- Target FadeSEC_test.exe
- Size 729KB
- SHA256 358207c5a0d39b07331623d758b6431d84a17a8be821cd4388e323ab50f8a259
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates VirtualBox registry keys
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Looks for VMWare services registry key.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2