General
- Target combined_payload.exe
- Size 1.5MB
- Sample260930-t33bbays8l
- SHA256 3209645653f48bf9ca125961e78c0133ba939ddcfb8908ec4854e91aa40676de
Score
9/10
Malware Config
Targets
-
- Target combined_payload.exe
- Size 1.5MB
- SHA256 3209645653f48bf9ca125961e78c0133ba939ddcfb8908ec4854e91aa40676de
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Modifies Windows Firewall
-
Disables service(s)
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2