4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12

General

Target
Terentiy.exe
Size 3.5MB
Sample260814-vhsrtaxfmc
SHA256 4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12
MD5 4afa847a6650d601f6ed613bd15b6a47
SHA1 c44862aa060b9690b53a1d39f2cdd52179506c7a
SHA512 7b0548d721771aed9d3932e0a28a974d9bf71e1da282315191ed875cac2f0ed54d3294b62fc8c885e6b6a04a7853ba68b4409bf34a0cb8c23b9f290cea3306a9
SSDEEP 49152:Tsp/Yx6lMQ+pLxrBdJdvd1dWdkdyS0m3WAZcS5huGvYontIz0Q6:wVLsjZcS5huGvYontIz0Q6
TLSH
T1AB06F65369DB0CE9CED667B8A5C76235A338FD71CA291F2BA604C1313C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Terentiy.exe
- Size 3.5MB
- SHA256 4a7567f06f698f1b4ff670e68f899da8416c9799ce791c63a43cd40f73aafa12
- MD5 4afa847a6650d601f6ed613bd15b6a47
- SHA1 c44862aa060b9690b53a1d39f2cdd52179506c7a
- SHA512 7b0548d721771aed9d3932e0a28a974d9bf71e1da282315191ed875cac2f0ed54d3294b62fc8c885e6b6a04a7853ba68b4409bf34a0cb8c23b9f290cea3306a9
- SSDEEP 49152:Tsp/Yx6lMQ+pLxrBdJdvd1dWdkdyS0m3WAZcS5huGvYontIz0Q6:wVLsjZcS5huGvYontIz0Q6
- TLSH
  T1AB06F65369DB0CE9CED667B8A5C76235A338FD71CA291F2BA604C1313C536C06E6EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware trojan
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1