138ba46aa866b05965842d56b5b71d1677bf1fa54dfbb1404265ef8b759ec8ce

General

Target
Terentiy.exe
Size 3.5MB
Sample260814-xefn7aygrf
SHA256 138ba46aa866b05965842d56b5b71d1677bf1fa54dfbb1404265ef8b759ec8ce
MD5 225290510b563c9695656c55aced00f0
SHA1 abf2458b92d21623c78899679c9d2fe09c93de6d
SHA512 2392a42493d9a1c8e95a85984842cba76ae2116eb452bd08a3e2c533a14379d9cf818de4a1eb55b4d17d67664c95d9cc4932576cee946eec7dfcae6fc46c8747
SSDEEP 49152:6uhW8GH/6WN+Wx22tlG2Q2dJdvd1dWdkd1Sjlx1OMdZcS5huGvYontu9ux4:jPsg3xtZcS5huGvYontu9ux4
TLSH
T13B06F75369DB0CA9CDD667BCA5C76335A338FD71CA291F3BA608C1212C536C06E6EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  Terentiy.exe
- Size 3.5MB
- SHA256 138ba46aa866b05965842d56b5b71d1677bf1fa54dfbb1404265ef8b759ec8ce
- MD5 225290510b563c9695656c55aced00f0
- SHA1 abf2458b92d21623c78899679c9d2fe09c93de6d
- SHA512 2392a42493d9a1c8e95a85984842cba76ae2116eb452bd08a3e2c533a14379d9cf818de4a1eb55b4d17d67664c95d9cc4932576cee946eec7dfcae6fc46c8747
- SSDEEP 49152:6uhW8GH/6WN+Wx22tlG2Q2dJdvd1dWdkd1Sjlx1OMdZcS5huGvYontu9ux4:jPsg3xtZcS5huGvYontu9ux4
- TLSH
  T13B06F75369DB0CA9CDD667BCA5C76335A338FD71CA291F3BA608C1212C536C06E6EB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion evasion execution persistence privilege_escalation ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1