Overview

overview

10

Static

static

3b910dce05...28.exe

windows7-x64

10

3b910dce05...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b910dce05a7207cd1ad34af2b24e428

  • Size

    388KB

  • Sample

    221123-g67c8aha6y

  • MD5

    3b910dce05a7207cd1ad34af2b24e428

  • SHA1

    f3c01d2c305a1b3a737ad2b73c3ba22558fc94f7

  • SHA256

    c0cbd6339026f42a838278795dbf8fa5ac11d8f6fb751e50289847b01a736823

  • SHA512

    8683a976b8f376dee448e285fa396b333444af3164083e93b7ab86902a3ea79a9d241494f9e20112967d3fd35fa881279ffc071791fbf9c5581829bb75a04524

  • SSDEEP

    6144:pOYGXaPNxdgSdcq2pVZPOJHAbKSXXIEmqF4fmq7k3ivPjVbdgZ/:1GqN/XdctpVtkiXXIEduOZij34

Score
10/10
ransomware

Malware Config

Targets

    • Target

      3b910dce05a7207cd1ad34af2b24e428

    • Size

      388KB

    • MD5

      3b910dce05a7207cd1ad34af2b24e428

    • SHA1

      f3c01d2c305a1b3a737ad2b73c3ba22558fc94f7

    • SHA256

      c0cbd6339026f42a838278795dbf8fa5ac11d8f6fb751e50289847b01a736823

    • SHA512

      8683a976b8f376dee448e285fa396b333444af3164083e93b7ab86902a3ea79a9d241494f9e20112967d3fd35fa881279ffc071791fbf9c5581829bb75a04524

    • SSDEEP

      6144:pOYGXaPNxdgSdcq2pVZPOJHAbKSXXIEmqF4fmq7k3ivPjVbdgZ/:1GqN/XdctpVtkiXXIEduOZij34

    Score
    10/10
    ransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks