a7d38e816e6bb8675288a7fd277e7b1611683eb30ae9b6e6d0a9b544198a6edb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a7d38e816e6bb8675288a7fd277e7b1611683eb30ae9b6e6d0a9b544198a6edb
Size

940KB
Sample

221012-eyyd8scdc3
MD5

7c88843932ed5fca7c04eb20ff322ab6
SHA1

247b25a926ab2bc863c8f2bc1aa28705edb044af
SHA256

a7d38e816e6bb8675288a7fd277e7b1611683eb30ae9b6e6d0a9b544198a6edb
SHA512

be5ee6db1101e00728edb4a5154d33b95f90a9deae2ea209d2139586af362407feb65c5b46d7505608d7f444fbe325ef311a82f5b6600b1d6ade617c83237997
SSDEEP

12288:pHD1FSuOhii2uu1czdSgWP3zLVQHAL6mG0dh74oV:hq/IgWP3zLSHA+pGj

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  a7d38e816e6bb8675288a7fd277e7b1611683eb30ae9b6e6d0a9b544198a6edb
- Size
  
  940KB
- MD5
  
  7c88843932ed5fca7c04eb20ff322ab6
- SHA1
  
  247b25a926ab2bc863c8f2bc1aa28705edb044af
- SHA256
  
  a7d38e816e6bb8675288a7fd277e7b1611683eb30ae9b6e6d0a9b544198a6edb
- SHA512
  
  be5ee6db1101e00728edb4a5154d33b95f90a9deae2ea209d2139586af362407feb65c5b46d7505608d7f444fbe325ef311a82f5b6600b1d6ade617c83237997
- SSDEEP
  
  12288:pHD1FSuOhii2uu1czdSgWP3zLVQHAL6mG0dh74oV:hq/IgWP3zLSHA+pGj
Score

9^/10

persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomwarespywarestealer

behavioral2

persistenceransomwarespywarestealer