General
- Target nomachine_9.8.2_1_x64.exe
- Size 77.1MB
- Sample260910-tnmbjssclg
- SHA256 c22415f3eae312e24a78a622cf126d0e79be0581102dbd2f6679d19dd29c49d2
Malware Config
Targets
-
- Target nomachine_9.8.2_1_x64.exe
- Size 77.1MB
- SHA256 c22415f3eae312e24a78a622cf126d0e79be0581102dbd2f6679d19dd29c49d2
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Possible privilege escalation attempt
-
Modifies file permissions
-
Modifies WinLogon
-
Boot or Logon Autostart Execution: Authentication Package
Suspicious Windows Authentication Registry Modification.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a new local user account
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Drops file in System32 directory
-
Modifies visibility of existing users in the login screen
A user account was hidden or made visible on the Windows login screen through a registry modification.
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
2Authentication Package
1Winlogon Helper DLL
1Create Account
1Local Account
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
2Authentication Package
1Winlogon Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
1Hidden Users
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1