General
- Target 18a03be9fecd8be95fdac6cb5b330d35ac032ff418f6b81fc511e032cbb6edbb
- Size 296KB
- Sample260821-ddc25afl61
- SHA256 18a03be9fecd8be95fdac6cb5b330d35ac032ff418f6b81fc511e032cbb6edbb
Malware Config
Targets
-
- Target 18a03be9fecd8be95fdac6cb5b330d35ac032ff418f6b81fc511e032cbb6edbb
- Size 296KB
- SHA256 18a03be9fecd8be95fdac6cb5b330d35ac032ff418f6b81fc511e032cbb6edbb
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Event Triggered Execution: Image File Execution Options Injection
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Modifies Windows Firewall
-
Modifies file permissions
-
Stops running service(s)
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
5Clear Persistence
1File Deletion
4Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1