Overview

overview

9

Static

static

98e3304a43...74.exe

windows7_x64

9

98e3304a43...74.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74.zip

  • Size

    261KB

  • Sample

    210411-fwd62zgbks

  • MD5

    b8b03bacfea40bed187b46ea232abd87

  • SHA1

    4c73ace20712a0f19c4feb1419d0e6b1f8696ad6

  • SHA256

    d29e1ddc9df83e5e4a3d8e94b927785ed82be4334557beaa39339404e8271607

  • SHA512

    13bbdb47f4e0f34c4229ae5672819f31fe6f076c6a8831875eee4d7692ed8201b4d34cb233d2f36ef5201fe74527548689d8ec33d671d6b6bb37f9b59cec5c12

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74.exe

    • Size

      386KB

    • MD5

      f6587e051ff9bf2e20825470ae5b3775

    • SHA1

      9b28d1e6cbff6b1397712a49c540b2ef999d78bc

    • SHA256

      98e3304a43402227458a979aad31e2ec1543c0c5d58c118d0a8fa8c70cc78d74

    • SHA512

      b3cd1c3577fac05cf318cb8c4a34f6afb3a44e0abe2e2bfc81ca246e503e0c9ac3daac794c87993f3eac82859b6692ae31bfe618a11099f87e5fd5a731950626

    Score
    9/10
    ransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

File Deletion

3
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3
T1490

Tasks