Overview

overview

8

Static

static

3

in-2010022...-1.jar

windows10-ltsc_2021-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    PRISM_in-20100223 Multiplayer.zip
  • Size 1.3MB
  • Sample260907-tzvr3acq4y
  • SHA256 543d68e3a61417fe95dbce125b084499c0d88400684cc5c13a1a07a029210d0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Targets

    • Target
      in-20100223 Multiplayer/libraries/customjar-1.jar
    • Size 1.4MB
    • SHA256 554fbd7561c5b64a5850eec1ce3cbca2b3b3d757fe42a3903debfdccb92d2dbc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoverypersistenceransomware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks