Overview

overview

8

Static

static

1

config.xml

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    config.xml
  • Size 1KB
  • Sample260910-a5fesashqb
  • SHA256 1fcf229f71521fadfe59681f63b365e7ee70dcaf160c72fb80f51ed757f3e537
  • MD5 SHA1 SHA512 TLSH
Score
8/10
credential_accessdiscoverypersistenceransomwarestealer

Malware Config

Targets

    • Target
      config.xml
    • Size 1KB
    • SHA256 1fcf229f71521fadfe59681f63b365e7ee70dcaf160c72fb80f51ed757f3e537
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    credential_accessdiscoverypersistenceransomwarestealer

    • Contacts a large (512) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks