8c5af3d31b5c52c76eb0d928bbb77feb55bbb25a6b072f3a1a293e6d8b48f070

General

Target
MaxLocker_test.exe
Size 4.0MB
Sample260928-yn8a8sseja
SHA256 8c5af3d31b5c52c76eb0d928bbb77feb55bbb25a6b072f3a1a293e6d8b48f070
MD5 3ba8f0b332e6b825d578224a7c180c79
SHA1 144555ff6bce8e0fdb58e5a029981905e6eda5aa
SHA512 ea2ccf0ba8cb5da5b2f508dfe983c66f6b6a1bc6651352281a0324814b9f0667b0f1021184049e4974c4b2ee93639459d1d174e66413b3174e20999ab9c9db33
SSDEEP 98304:VRy3bEN4OVu3eMNnAeum5bC9zHNibjPUXB:f4f3l9AGC9ze4
TLSH
T12D16010F0340EA2DF8578E7930E30089E5A03FA75D24FDE98E58B356E573AE657C6252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  MaxLocker_test.exe
- Size 4.0MB
- SHA256 8c5af3d31b5c52c76eb0d928bbb77feb55bbb25a6b072f3a1a293e6d8b48f070
- MD5 3ba8f0b332e6b825d578224a7c180c79
- SHA1 144555ff6bce8e0fdb58e5a029981905e6eda5aa
- SHA512 ea2ccf0ba8cb5da5b2f508dfe983c66f6b6a1bc6651352281a0324814b9f0667b0f1021184049e4974c4b2ee93639459d1d174e66413b3174e20999ab9c9db33
- SSDEEP 98304:VRy3bEN4OVu3eMNnAeum5bC9zHNibjPUXB:f4f3l9AGC9ze4
- TLSH
  T12D16010F0340EA2DF8578E7930E30089E5A03FA75D24FDE98E58B356E573AE657C6252
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware trojan adware discovery spyware
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2