eeaa8a8db280eaec2627078ca7be4ebc6c7842b5999eb294e22550fec505d48d | Triage

Sharing

General

Target

eeaa8a8db280eaec2627078ca7be4ebc6c7842b5999eb294e22550fec505d48d
Size

4.8MB
Sample

221020-x17pssbca7
MD5

f7c99955c9f02ed41275edfa2a235414
SHA1

8b38b83d42ae97d8af70ab1c9cdce7d6c486636b
SHA256

eeaa8a8db280eaec2627078ca7be4ebc6c7842b5999eb294e22550fec505d48d
SHA512

e82ee9f5a733eb5d933cabf702504a861e1a47719a3229e97003bce52144fbdbfbc818f902c47d11d82e143583f705efad1b5a37557dc4d652b7c6a20c31d56d
SSDEEP

24576:u666666666m6666666666666666666666666666666666666666666666666666r:

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  eeaa8a8db280eaec2627078ca7be4ebc6c7842b5999eb294e22550fec505d48d
- Size
  
  4.8MB
- MD5
  
  f7c99955c9f02ed41275edfa2a235414
- SHA1
  
  8b38b83d42ae97d8af70ab1c9cdce7d6c486636b
- SHA256
  
  eeaa8a8db280eaec2627078ca7be4ebc6c7842b5999eb294e22550fec505d48d
- SHA512
  
  e82ee9f5a733eb5d933cabf702504a861e1a47719a3229e97003bce52144fbdbfbc818f902c47d11d82e143583f705efad1b5a37557dc4d652b7c6a20c31d56d
- SSDEEP
  
  24576:u666666666m6666666666666666666666666666666666666666666666666666r:
Score

9^/10

persistence ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Replication Through Removable Media

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomwarespywarestealer

behavioral2

persistencespywarestealer