hxxp://we[.]tl/t-7si6bGYMbk | Triage

Submit
Reports

Overview

overview

8

Static

static

URLScan

urlscan

http://we.tl/t-7si6b...

windows10-2004-x64

8

Resubmissions

18/10/2022, 01:25 UTC

221018-btf3lsebgp 1

18/10/2022, 01:23 UTC

221018-bsbfqsdhf5 1

17/10/2022, 09:00 UTC

221017-kyevsabca2 9

17/10/2022, 09:00 UTC

221017-kyaaasbbh7 1

17/10/2022, 08:48 UTC

221017-kqj5jabbd6 8

17/10/2022, 08:37 UTC

221017-kjge3abcer 8

Sharing

General

Target

http://we.tl/t-7si6bGYMbk
Sample

221017-kjge3abcer

Score

8^/10

persistence ransomware

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://we.tl/t-7si6bGYMbk

Resource

win10v2004-20220812-en

persistence ransomware

windows10-2004-x64

22 signatures

1800 seconds

Malware Config

Targets

- Target
  
  http://we.tl/t-7si6bGYMbk
Score

8^/10

persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

persistenceransomware

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.