Overview

overview

8

Static

static

3

a8051a18ea157c68.zip

windows10-ltsc_2021-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    a8051a18ea157c68.zip
  • Size 63.7MB
  • Sample260815-xav83ssbkd
  • SHA256 70496dfc5233a49039fd4bb217c4f08ab433ce2766aaca6f04ce9851f4fbf6d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploitpersistenceransomware

Malware Config

Targets

    • Target
      a8051a18ea157c68.zip
    • Size 63.7MB
    • SHA256 70496dfc5233a49039fd4bb217c4f08ab433ce2766aaca6f04ce9851f4fbf6d7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionexploitpersistenceransomware

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to get system information as a root user.

      execution

    • Disables RegEdit via registry modification

      defense_evasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Possible privilege escalation attempt

      exploit

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Suspicious clipboard content.

      A suspicious script was copied to clipboard.

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops desktop.ini file(s)

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks