General
- Target sample
- Size 276KB
- Sample261014-c1swest19m
- SHA256 2f0b73f7b24ca742ba085102b0f913d3d8ec8d1943a8df9a13a486556116b8df
Malware Config
Targets
-
- Target sample
- Size 276KB
- SHA256 2f0b73f7b24ca742ba085102b0f913d3d8ec8d1943a8df9a13a486556116b8df
Score10/10Detects HiddenTear Ransomware
Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Disables Task Manager via registry modification
Downloads MZ/PE file
Executes dropped EXE
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Network Share Discovery
Attempt to gather information on host network.
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
Drops file in System32 directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Process Hollowing
1Defense Evasion
Debugger Evasion
1Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
3Process Injection
1Process Hollowing
1Discovery
Browser Information Discovery
1Debugger Evasion
1Network Share Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1