ac76df3e151836e1845f6bd89370b748e0293e7182390831a18d148a13456904 | Triage

Sharing

General

Target

ac76df3e151836e1845f6bd89370b748e0293e7182390831a18d148a13456904
Size

446KB
Sample

221128-pe2bwsge8v
MD5

ac62c4a27d7eebbe97268a3304a68814
SHA1

adee4db7f706f2b307ad03b8e5d4eee51fdce592
SHA256

ac76df3e151836e1845f6bd89370b748e0293e7182390831a18d148a13456904
SHA512

a35666fd3f70e036a65f65e1dc9eb7f4bc06b9fc8e69f7ab4400b5ba9e9825f677f8f7c518197baa3623c1427759ac42917290dbf2681151eeac08aa0dda2434
SSDEEP

6144:hMUGDTJpucTOv8Jif9ut2F1erwYCYHNU4RVmJ5aKQPXAQFo4hZcAEcuzwILxXtsZ:hMvRdiItIeMYC14vmJQKUAQFZz/0nw

Score

10^/10

evasion persistence ransomware spyware stealer trojan

Malware Config

Targets

- Target
  
  ac76df3e151836e1845f6bd89370b748e0293e7182390831a18d148a13456904
- Size
  
  446KB
- MD5
  
  ac62c4a27d7eebbe97268a3304a68814
- SHA1
  
  adee4db7f706f2b307ad03b8e5d4eee51fdce592
- SHA256
  
  ac76df3e151836e1845f6bd89370b748e0293e7182390831a18d148a13456904
- SHA512
  
  a35666fd3f70e036a65f65e1dc9eb7f4bc06b9fc8e69f7ab4400b5ba9e9825f677f8f7c518197baa3623c1427759ac42917290dbf2681151eeac08aa0dda2434
- SSDEEP
  
  6144:hMUGDTJpucTOv8Jif9ut2F1erwYCYHNU4RVmJ5aKQPXAQFo4hZcAEcuzwILxXtsZ:hMvRdiItIeMYC14vmJQKUAQFZz/0nw
Score

10^/10

evasion persistence ransomware spyware stealer trojan
- Modifies visibility of file extensions in Explorer
  evasion
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

Defense Evasion

Hidden Files and Directories

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistenceransomwarespywarestealertrojan

behavioral2

evasionpersistencespywarestealertrojan