Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://release-asse...

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://release-assets.githubusercontent.com/github-production-release-asset/1359197224/125a0748-dbde-411e-b65f-bc4bb6348874?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-10-11T13%3A27%3A20Z&rscd=attachment%3B+filename%3Dtime.to.die.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-10-11T12%3A26%3A28Z&ske=2026-10-11T13%3A27%3A20Z&sks=b&skv=2018-11-09&sig=GW42BIhtkyNKpYTldjtDNWe%2F3bsf06Aez9WJVCK6mC0%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc5MTcyNjI0OSwibmJmIjoxNzkxNzIyNjQ5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.zpc50DVNcgdq-YMrwfUPpQqGyABlu9rL_zpYoCE-yqE&response-content-disposition=attachment%3B%20filename%3Dtime.to.die.exe&response-content-type=application%2Foctet-stream
  • Sample261011-py5teshh74
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwaretrojan

Malware Config

Targets

    • Target
      https://release-assets.githubusercontent.com/github-production-release-asset/1359197224/125a0748-dbde-411e-b65f-bc4bb6348874?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-10-11T13%3A27%3A20Z&rscd=attachment%3B+filename%3Dtime.to.die.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-10-11T12%3A26%3A28Z&ske=2026-10-11T13%3A27%3A20Z&sks=b&skv=2018-11-09&sig=GW42BIhtkyNKpYTldjtDNWe%2F3bsf06Aez9WJVCK6mC0%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc5MTcyNjI0OSwibmJmIjoxNzkxNzIyNjQ5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.zpc50DVNcgdq-YMrwfUPpQqGyABlu9rL_zpYoCE-yqE&response-content-disposition=attachment%3B%20filename%3Dtime.to.die.exe&response-content-type=application%2Foctet-stream
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationransomwaretrojan

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Disables Task Manager via registry modification

      defense_evasion

    • Disables one or more Microsoft Defender components

      Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

      defense_evasion

    • Downloads MZ/PE file

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Disables automatic submission of suspicious files to Microsoft by Windows Defender

      Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

      defense_evasion

    • Disables service(s)

      defense_evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Stops running service(s)

      defense_evasionexecution

    • Windows security modification

      defense_evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Defense Evasion

Impair Defenses

5
T1562

Disable or Modify Tools

4
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

5
T1082

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2
T1489

Tasks