Overview

overview

9

Static

static

cc5278242b...3b.exe

windows7-x64

9

cc5278242b...3b.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc5278242b8a119b0cdcdf10f48269b21fdcecfbb2ac1292b3548a54eaee853b

  • Size

    280KB

  • Sample

    221002-2wj56affdr

  • MD5

    630c1481a23ccb384e983be564b86560

  • SHA1

    0c1ea1cfcae42e2c51b8edc11e11272eb044ca87

  • SHA256

    cc5278242b8a119b0cdcdf10f48269b21fdcecfbb2ac1292b3548a54eaee853b

  • SHA512

    4a41ad29df9f574bbf928de1f08e79d7f23bb5628348402998ebbfc76a49d55ec2a89691f59b570e126ffe614aa1c9e839b99fad851168987067d07245317796

  • SSDEEP

    3072:PTfF8DHWIsMNjHVb7D22yPJAANQRU3Cb8Zteb3sPWZY8mgOFPtX1ObdM:PjGTHsMjH121Es3CbLWcOPob+

Score
9/10
persistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      cc5278242b8a119b0cdcdf10f48269b21fdcecfbb2ac1292b3548a54eaee853b

    • Size

      280KB

    • MD5

      630c1481a23ccb384e983be564b86560

    • SHA1

      0c1ea1cfcae42e2c51b8edc11e11272eb044ca87

    • SHA256

      cc5278242b8a119b0cdcdf10f48269b21fdcecfbb2ac1292b3548a54eaee853b

    • SHA512

      4a41ad29df9f574bbf928de1f08e79d7f23bb5628348402998ebbfc76a49d55ec2a89691f59b570e126ffe614aa1c9e839b99fad851168987067d07245317796

    • SSDEEP

      3072:PTfF8DHWIsMNjHVb7D22yPJAANQRU3Cb8Zteb3sPWZY8mgOFPtX1ObdM:PjGTHsMjH121Es3CbLWcOPob+

    Score
    9/10
    persistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks