General
- Target destroy_v4.exe
- Size 7.4MB
- Sample260919-sjhbcsxt2j
- SHA256 a8a5beb51896f40417044f60c927c6325ad5465acffec6ca7ad309b82dd19ee2
Score
10/10
Malware Config
Targets
-
- Target destroy_v4.exe
- Size 7.4MB
- SHA256 a8a5beb51896f40417044f60c927c6325ad5465acffec6ca7ad309b82dd19ee2
Score10/10-
Modifies Windows Defender TamperProtection settings
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Possible privilege escalation attempt
-
Disables service(s)
-
Loads dropped DLL
-
Modifies file permissions
-
Stops running service(s)
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1