General
- Target http://google.com
- Sample261008-dnq2qsa13p
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target http://google.com
Detects HiddenTear Ransomware
Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies boot configuration data using bcdedit
Disables Task Manager via registry modification
Modifies Windows Firewall
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1