Overview

overview

10

Static

static

5fcf5f6ab5...5f.exe

windows7_x64

10

5fcf5f6ab5...5f.exe

windows10-2004_x64

8

Resubmissions

28/02/2024, 15:58

240228-teh8jaff3w 10

28/02/2024, 15:57

240228-tdw31afe56 7

15/02/2022, 08:57

220215-kwk9sadae3 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5fcf5f6ab5218cdcc5745e391ff77ec1e7769134048c9f8432f1325f3c59dd5f

  • Size

    578KB

  • Sample

    220215-kwk9sadae3

  • MD5

    51ecec287af1910aba3e7f4d724890cc

  • SHA1

    b1e29be1a7d502a8fefeecab981829b2c6ff4818

  • SHA256

    5fcf5f6ab5218cdcc5745e391ff77ec1e7769134048c9f8432f1325f3c59dd5f

  • SHA512

    1d4edc289e92fd328abbd18a0edbf07a5a820712ed5eaacc57d4ac6054c849df7fe525d254fb9c6e2a5d83ed757e57ff3c68986be4d959cd67437901615517ee

Score
10/10
evasionmacropersistenceransomware

Malware Config

Targets

    • Target

      5fcf5f6ab5218cdcc5745e391ff77ec1e7769134048c9f8432f1325f3c59dd5f

    • Size

      578KB

    • MD5

      51ecec287af1910aba3e7f4d724890cc

    • SHA1

      b1e29be1a7d502a8fefeecab981829b2c6ff4818

    • SHA256

      5fcf5f6ab5218cdcc5745e391ff77ec1e7769134048c9f8432f1325f3c59dd5f

    • SHA512

      1d4edc289e92fd328abbd18a0edbf07a5a820712ed5eaacc57d4ac6054c849df7fe525d254fb9c6e2a5d83ed757e57ff3c68986be4d959cd67437901615517ee

    Score
    10/10
    evasionmacropersistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Disables RegEdit via registry modification

      evasion

    • Executes dropped EXE

    • Suspicious Office macro

      Office document equipped with macros.

      macro

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks