Overview

overview

9

Static

static

8b8db2381a...8d.exe

windows7-x64

9

8b8db2381a...8d.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b8db2381a7c6c2dfc0fecf811674bc43ce5e2027c4b1248a7746aa12665a38d

  • Size

    236KB

  • Sample

    221123-t3qbrafg94

  • MD5

    2c9b73837f952efde030bb1dc7d18976

  • SHA1

    c010231c403427df5a66f26caeb86a5909233b99

  • SHA256

    8b8db2381a7c6c2dfc0fecf811674bc43ce5e2027c4b1248a7746aa12665a38d

  • SHA512

    0a60f0ae5a59da80efe53be00d4337ba76842157512b3ef2fe869a863e6d1b77a96a4255d2ecbce8266a07fc207cfdb80f0779061f6e83b293ebca7969733408

  • SSDEEP

    3072:2YMUflz+rRo0jSc2uCwy6irfmE0FZFUwr95N5OWISZTbUqMCa+RifgPxz+tB99y6:v+CKZy6zEbC5N52LCWYPxkBteQ

Score
9/10
persistenceransomware

Malware Config

Targets

    • Target

      8b8db2381a7c6c2dfc0fecf811674bc43ce5e2027c4b1248a7746aa12665a38d

    • Size

      236KB

    • MD5

      2c9b73837f952efde030bb1dc7d18976

    • SHA1

      c010231c403427df5a66f26caeb86a5909233b99

    • SHA256

      8b8db2381a7c6c2dfc0fecf811674bc43ce5e2027c4b1248a7746aa12665a38d

    • SHA512

      0a60f0ae5a59da80efe53be00d4337ba76842157512b3ef2fe869a863e6d1b77a96a4255d2ecbce8266a07fc207cfdb80f0779061f6e83b293ebca7969733408

    • SSDEEP

      3072:2YMUflz+rRo0jSc2uCwy6irfmE0FZFUwr95N5OWISZTbUqMCa+RifgPxz+tB99y6:v+CKZy6zEbC5N52LCWYPxkBteQ

    Score
    9/10
    ransomwarepersistence

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks