0bda2380e08ad9d86b1803622727e4e2baa6c3292af5610776ee6ba0320886c3

General

Target
Terentiy.exe
Size 3.5MB
Sample260814-v2epasyvgw
SHA256 0bda2380e08ad9d86b1803622727e4e2baa6c3292af5610776ee6ba0320886c3
MD5 725afedef995b006fe13300c0b643834
SHA1 d5a0d757896f41e23b21b39b1deb3d1083f7ebff
SHA512 149d45b69b69e5335a36c707db1a3e1ec0e8e2967b3b47194c7df750d7a17587c606e7a8fa5bd6711e6f37ff97ed586a94d63dd4d8399cf375ac67e80bcce893
SSDEEP 49152:JqldDo5kGl6jvF83F2suZbosdJdvd1dWdkdqDZcS5huGvYontu9ix3:m1TSdDZcS5huGvYontu9ix3
TLSH
T1B506F75369DB0CE9CDD267B8A5C76335A738FD71CA291F3BA608C1212C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Terentiy.exe
- Size 3.5MB
- SHA256 0bda2380e08ad9d86b1803622727e4e2baa6c3292af5610776ee6ba0320886c3
- MD5 725afedef995b006fe13300c0b643834
- SHA1 d5a0d757896f41e23b21b39b1deb3d1083f7ebff
- SHA512 149d45b69b69e5335a36c707db1a3e1ec0e8e2967b3b47194c7df750d7a17587c606e7a8fa5bd6711e6f37ff97ed586a94d63dd4d8399cf375ac67e80bcce893
- SSDEEP 49152:JqldDo5kGl6jvF83F2suZbosdJdvd1dWdkdqDZcS5huGvYontu9ix3:m1TSdDZcS5huGvYontu9ix3
- TLSH
  T1B506F75369DB0CE9CDD267B8A5C76335A738FD71CA291F3BA608C1212C536C06E6EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence ransomware trojan
- UAC bypass
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1