Overview

overview

10

Static

static

9534e9f11f...33.exe

windows7-x64

10

9534e9f11f...33.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9534e9f11f274b0643f099fafd6895452e15398da308b88f64049fd609215333

  • Size

    867KB

  • Sample

    221119-1elf8afe7x

  • MD5

    1838114e4893a371a0e4d3e8a0e88570

  • SHA1

    490eca7e5517b3adfd7e643c595e687b42df5352

  • SHA256

    9534e9f11f274b0643f099fafd6895452e15398da308b88f64049fd609215333

  • SHA512

    dcaaa2580dce75961f191877f25781b9644118ead11d1612234bcc11bd54e4735bf8ca4f6dde3599a1d48762a17c9a79c2049f28da19e20dcc98c63dbfcd5849

  • SSDEEP

    12288:pq8hiZ2zrU8ge+g/3PDarqaH0AZYSrW/TQpXqRAwYIm/NTn7g:pa8/N/rlBAZP2QpXPBk

Score
10/10
evasionmacropersistenceransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      9534e9f11f274b0643f099fafd6895452e15398da308b88f64049fd609215333

    • Size

      867KB

    • MD5

      1838114e4893a371a0e4d3e8a0e88570

    • SHA1

      490eca7e5517b3adfd7e643c595e687b42df5352

    • SHA256

      9534e9f11f274b0643f099fafd6895452e15398da308b88f64049fd609215333

    • SHA512

      dcaaa2580dce75961f191877f25781b9644118ead11d1612234bcc11bd54e4735bf8ca4f6dde3599a1d48762a17c9a79c2049f28da19e20dcc98c63dbfcd5849

    • SSDEEP

      12288:pq8hiZ2zrU8ge+g/3PDarqaH0AZYSrW/TQpXqRAwYIm/NTn7g:pa8/N/rlBAZP2QpXPBk

    Score
    10/10
    evasionmacropersistenceransomwarespywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Document created with cracked Office version

      Office document contains Grizli777 string known to be caused by using a cracked version of the software.

      macro

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

5
T1112

Hidden Files and Directories

1
T1158

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks