Overview

overview

8

Static

static

129413000f...le.exe

windows7_x64

8

129413000f...le.exe

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample

  • Size

    269KB

  • Sample

    210726-xd6dhcxtqs

  • MD5

    d0c47bd4b16f5c77ef114004b6b464b0

  • SHA1

    b99d9b3228ce391e4768e5d60895195ed27f2c8f

  • SHA256

    129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7

  • SHA512

    dea1242ba53814058219d806f80cc633e61470c9563ff32c2d878e9e4808224ea6fade1098575aab1d3c4d55e2c3be57abcdf52315e4cef0f167ccfa5d42c360

Score
8/10
persistenceransomware

Malware Config

Targets

    • Target

      129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample

    • Size

      269KB

    • MD5

      d0c47bd4b16f5c77ef114004b6b464b0

    • SHA1

      b99d9b3228ce391e4768e5d60895195ed27f2c8f

    • SHA256

      129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7

    • SHA512

      dea1242ba53814058219d806f80cc633e61470c9563ff32c2d878e9e4808224ea6fade1098575aab1d3c4d55e2c3be57abcdf52315e4cef0f167ccfa5d42c360

    Score
    8/10
    persistenceransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks