General
- Target RIBBONLOCK.exe
- Size 129.1MB
- Sample261027-wtbhcae16w
- SHA256 2cbc006925d2ef75aaf85b76db4a4c29404e08f85d71c82fec0d904a1c67ed96
Score
8/10
Malware Config
Targets
-
- Target RIBBONLOCK.exe
- Size 129.1MB
- SHA256 2cbc006925d2ef75aaf85b76db4a4c29404e08f85d71c82fec0d904a1c67ed96
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt
-
Loads dropped DLL
-
Modifies file permissions
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
- Target cakelock.pyc
- Size 9KB
- SHA256 43c798b2d84237eb213bec69f90ee8276d228995ec48aa6a8c1a94c204fac0ab
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
1Clear Persistence
1Modify Registry
1