General
- Target janqi_raas.exe
- Size 253KB
- Sample260727-1fklba1hmh
- SHA256 04f70de1d4ece9350699dc7aa67c9c6e337ef1ff40e8ea4683c4d05c74b822bd
Score
9/10
Malware Config
Targets
-
- Target janqi_raas.exe
- Size 253KB
- SHA256 04f70de1d4ece9350699dc7aa67c9c6e337ef1ff40e8ea4683c4d05c74b822bd
Score9/10-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell
Run Powershell command to delete shadowcopy.
-
Modifies Windows Firewall
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1