Overview

overview

10

Static

static

117313c5a8...ea.exe

windows7_x64

10

117313c5a8...ea.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    117313c5a8ebd05bf5ae7d7278790498cac8fd001c0903f17bc8ab51003056ea.zip

  • Size

    235KB

  • Sample

    220706-hwzq3aaaam

  • MD5

    db375de9bd3f7025e74e1bd23606450b

  • SHA1

    49513b28b354c9e201fb0ead38bd461b1a0a1958

  • SHA256

    e006b7fc3e16d17d9460d3d97d179bdea99fb377442eac13c3156c0122aa2320

  • SHA512

    0f80f8106de47767ab668c94416f09c7e2aab55a1535df221f7d10f97e179a90f814d4affc6e9165529e5058ab6f969a1dcef6af0368d240a047361d2f682287

Score
10/10
persistencesuricataupx

Malware Config

Targets

    • Target

      117313c5a8ebd05bf5ae7d7278790498cac8fd001c0903f17bc8ab51003056ea

    • Size

      292KB

    • MD5

      3d708e043b684960c752c0e9a532b56b

    • SHA1

      1b3dec7a79f93e21ebce4b7a82a49f1adb70e4fd

    • SHA256

      117313c5a8ebd05bf5ae7d7278790498cac8fd001c0903f17bc8ab51003056ea

    • SHA512

      8a87eb09796056dc4e5ff03dce3529e89a663171a8b7851c4db36568a25b2d3c5bf0a0ee1f26940e75895adb1b0ada745d9fc8028947bac9609f1340e7e6c8e5

    Score
    10/10
    persistencesuricataupx

    • suricata: ET MALWARE RansomCrypt Intial Check-in

      suricata: ET MALWARE RansomCrypt Intial Check-in

      suricata

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks