tokyocore | b1eeec69ad338af8fcb0d0df3963e21df1d38ce0c63f737d0e1e0c570582bbeb

General

Target
386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.zip
Size 736KB
Sample260910-vpmt5sem4s
SHA256 b1eeec69ad338af8fcb0d0df3963e21df1d38ce0c63f737d0e1e0c570582bbeb
MD5 606e1f8b3f49939e25acc5cbc25fb26a
SHA1 114928863d694df0905bcfd5945fe077d374a601
SHA512 b9605364b5f96401d2b00ed62fb8a2fb5eb49959093ed36e77899e4152cc3a16789ab11b4bcee679346d788bc5b6bd1a9864368109095a02a30cf03432aebd5c
SSDEEP 12288:fpivdhE1MwlfHadewcRDWlx3xqyX8trch6DGN52KKv3QGt3S1xHY7sGj:fMdhE1MmfUcRwWyX8trXG+KKvn3S1Wgc
TLSH
T159F433F03BBF9E9FCA70556FE68D95A3BE84B20025E81518F6FD428C9C754F0748A11A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc.exe
- Size 3.3MB
- SHA256 386fbb57ba83864ee57a9e8a271c6dc215dc20bb1521ee85ad414f0dc67babdc
- MD5 d77aa7f5bf7c008232f4cbec127c30db
- SHA1 3701617822f99debbf2579602b32eb99034581ad
- SHA512 dca182637bcc510cfba855040df4f422c30b7c42af48351281534fde1804341bb7359d3c0e61c3cde8085273c1ad8387e248ab49bb92fce3724aa96c9a4615c9
- SSDEEP 24576:i7MuEwvKJEdcI63li+WsOxP5g2IvMJJHfO2NprH2K:sMupsvBWsOxPVZJWEzP
- TLSH
  T12EF5D91BF7B610D5E1BAC039D553622AFC7134A6833C97EB92818E491B60BE4EE3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution tokyocore persistence privilege_escalation ransomware
- Detects TokyoCore
- Family: TokyoCore
  TokyoCore is a Windows ransomware written in C++.
  ransomware tokyocore
- Modifies WinLogon for persistence
  persistence
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Uses Session Manager for persistence
  Creates Session Manager registry key to run executable early in system boot.
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1