Overview

overview

10

Static

static

ransomware.exe

windows7_x64

10

ransomware.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ransomware

  • Size

    678KB

  • Sample

    200630-ns1w3kbn4j

  • MD5

    35271695a6202c514fef4520d49886ea

  • SHA1

    8a7cc5c0f41ae45064a88ec67ab0e8a3ca2514f2

  • SHA256

    58290a95e1795ec7312e4ce26bfff7e0fb7a620a3aac2627d3ae6c83f5a4bf60

  • SHA512

    ff9e77f83fc28c4461cd335bb41b762e93ac57ad15c2489631ed4869a0c1d0fb94b1491629fcb29bb96629a5dcaaeedc9b31b07055d1465a14a685235fd8d4f9

Score
10/10
evasionpersistenceransomwarespywaretrojan

Malware Config

Targets

    • Target

      ransomware

    • Size

      678KB

    • MD5

      35271695a6202c514fef4520d49886ea

    • SHA1

      8a7cc5c0f41ae45064a88ec67ab0e8a3ca2514f2

    • SHA256

      58290a95e1795ec7312e4ce26bfff7e0fb7a620a3aac2627d3ae6c83f5a4bf60

    • SHA512

      ff9e77f83fc28c4461cd335bb41b762e93ac57ad15c2489631ed4869a0c1d0fb94b1491629fcb29bb96629a5dcaaeedc9b31b07055d1465a14a685235fd8d4f9

    Score
    10/10
    evasiontrojanransomwarespywarepersistence

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

    • Modifies service

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks