Overview

overview

8

Static

static

1

teste.txt

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    teste.txt
  • Size 5B
  • Sample260826-epekrssbmb
  • SHA256 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
  • MD5 SHA1 SHA512
Score
8/10
defense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Targets

    • Target
      teste.txt
    • Size 5B
    • SHA256 46070d4bf934fb0d4b06d9e2c46e346944e322444900a435d7d9a95e6d7435f5
    • MD5 SHA1 SHA512
    Score
    8/10
    defense_evasiondiscoverypersistenceransomwarespywaretrojan

    • Downloads MZ/PE file

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks