22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249 | Triage

Submit
Reports

Overview

overview

9

Static

static

22f9cb5081...49.exe

windows7-x64

9

22f9cb5081...49.exe

windows10-2004-x64

3

Sharing

General

Target

22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249
Size

569KB
Sample

221126-amfb3acc5v
MD5

6e13ce8eed45e35d8fdaccd83fec9df0
SHA1

e5a907db2f97081efda62aeb91633c8bf062653f
SHA256

22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249
SHA512

787ec3a2984a6f43c80d98e22dbc20daaf65f53115949fa1426e2a6434cfe7fdaa6d39219a490153a9e85b905514b7416409bd79f8a60ef21f87f7024d488efd
SSDEEP

12288:Venw5KP26ei5Mw5cccjQEQ6JeyaJZIfbint7n:Vew5KP2635tIQ2JJ8Ket7

Score

9^/10

persistence ransomware

Static task

static1

Behavioral task

behavioral1

Sample

22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249.exe

Resource

win7-20220812-en

persistence ransomware

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249
- Size
  
  569KB
- MD5
  
  6e13ce8eed45e35d8fdaccd83fec9df0
- SHA1
  
  e5a907db2f97081efda62aeb91633c8bf062653f
- SHA256
  
  22f9cb5081ec252ba8a80d21c0c07a5c21487279e63cc175d59b921be273d249
- SHA512
  
  787ec3a2984a6f43c80d98e22dbc20daaf65f53115949fa1426e2a6434cfe7fdaa6d39219a490153a9e85b905514b7416409bd79f8a60ef21f87f7024d488efd
- SSDEEP
  
  12288:Venw5KP26ei5Mw5cccjQEQ6JeyaJZIfbint7n:Vew5KP2635tIQ2JJ8Ket7
Score

9^/10

persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

persistenceransomware

behavioral2

© 2018-2024

Terms | Privacy