General
- Target Update.exe
- Size 360KB
- Sample260728-lld86agd73
- SHA256 5d44033558871299a5fb181524419c281c03bb0a57b91e89412b7d14daec3808
Malware Config
Targets
-
- Target Update.exe
- Size 360KB
- SHA256 5d44033558871299a5fb181524419c281c03bb0a57b91e89412b7d14daec3808
Score10/10-
UAC bypass
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables Task Manager via registry modification
-
Disables service(s)
-
Stops running service(s)
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
2Disable or Modify Tools
1Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
2Pre-OS Boot
1Bootkit
1