b2950dd8c46d2dbfb2dcb4379eedbe3fe5e6bc0a13b6dbfc1e47983ba10b1399 | Triage™

Login
Reports

Overview

overview

Static

static

3

no_escape_all.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
no_escape_all.exe
Size 235KB
Sample260926-txde1axdkh
SHA256 b2950dd8c46d2dbfb2dcb4379eedbe3fe5e6bc0a13b6dbfc1e47983ba10b1399
MD5 a989efe907b65345da48f7b578454015
SHA1 393102020d038d3b2ff74b148b3625318a95a8f2
SHA512 21156fe3648810c9d29208c995f7713d19341abd22cca8db28f87c0096b8e7c9f135167c249a2932df1a6513000ddb216f6f0a7d2f6175fd6a152e437e98520d
SSDEEP 3072:EHISgZSkTacN9Qj4WF3hoWbexz7r0doFVLdZQDNdUfzXiJOkSh3:EHeSxsWM3z8do3LeN6hkSh
TLSH
T182342A469B92EFFBD910873588F70324BB35E1421B464FDB2E496130BF13BE94D66A48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution persistence ransomware trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

no_escape_all.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

16 signatures

150 seconds

bootkit defense_evasion evasion execution persistence ransomware trojan

Malware Config

Targets

- Target
  no_escape_all.exe
- Size 235KB
- SHA256 b2950dd8c46d2dbfb2dcb4379eedbe3fe5e6bc0a13b6dbfc1e47983ba10b1399
- MD5 a989efe907b65345da48f7b578454015
- SHA1 393102020d038d3b2ff74b148b3625318a95a8f2
- SHA512 21156fe3648810c9d29208c995f7713d19341abd22cca8db28f87c0096b8e7c9f135167c249a2932df1a6513000ddb216f6f0a7d2f6175fd6a152e437e98520d
- SSDEEP 3072:EHISgZSkTacN9Qj4WF3hoWbexz7r0doFVLdZQDNdUfzXiJOkSh3:EHeSxsWM3z8do3LeN6hkSh
- TLSH
  T182342A469B92EFFBD910873588F70324BB35E1421B464FDB2E496130BF13BE94D66A48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution persistence ransomware trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Modifies powershell logging option
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Indicator Removal

Clear Windows Event Logs

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

bootkitdefense_evasionevasionexecutionpersistenceransomwaretrojan

© 2018-2026

Terms | Privacy