Overview

overview

9

Static

static

f60bb4f7e9...63.exe

windows7-x64

9

f60bb4f7e9...63.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f60bb4f7e9a0bfc907b97dc4988e73f43375539e46ea4e88dcde95da70340063

  • Size

    240KB

  • Sample

    221126-fmskaage9x

  • MD5

    b8c0eedfe9d2b511cd073910c7e42f10

  • SHA1

    fe74589e2c22e0af63365236d01c467c77ee097a

  • SHA256

    f60bb4f7e9a0bfc907b97dc4988e73f43375539e46ea4e88dcde95da70340063

  • SHA512

    8c2a281682d0c5cfa54f088c77d5d979a6759fbbe0e015d9dd052fd3ef9f6a2b61bcc186939215a91a0a1281b3c58f71d5c5480f76de1eede55f8bc2c12316d6

  • SSDEEP

    6144:CJUTzlgAJsZZufV6SBJ2xsqP3EckX1laG:C2TxgAmH8V6SX2/PPu1lT

Score
9/10
persistenceransomware

Malware Config

Targets

    • Target

      f60bb4f7e9a0bfc907b97dc4988e73f43375539e46ea4e88dcde95da70340063

    • Size

      240KB

    • MD5

      b8c0eedfe9d2b511cd073910c7e42f10

    • SHA1

      fe74589e2c22e0af63365236d01c467c77ee097a

    • SHA256

      f60bb4f7e9a0bfc907b97dc4988e73f43375539e46ea4e88dcde95da70340063

    • SHA512

      8c2a281682d0c5cfa54f088c77d5d979a6759fbbe0e015d9dd052fd3ef9f6a2b61bcc186939215a91a0a1281b3c58f71d5c5480f76de1eede55f8bc2c12316d6

    • SSDEEP

      6144:CJUTzlgAJsZZufV6SBJ2xsqP3EckX1laG:C2TxgAmH8V6SX2/PPu1lT

    Score
    9/10
    ransomwarepersistence

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks