Overview

overview

10

Static

static

1a247db9ae...02.exe

windows7-x64

10

1a247db9ae...02.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1a247db9ae193938318c1935ebca3e258da2b1ba99902422066df28f4245a002

  • Size

    52KB

  • Sample

    221227-h2ggnshf4w

  • MD5

    19660b46a1d17197b4f9f77e0e8b2c58

  • SHA1

    ca057c6880fe2596193c64150d5f4d4b817be94e

  • SHA256

    1a247db9ae193938318c1935ebca3e258da2b1ba99902422066df28f4245a002

  • SHA512

    43614e6589d7c3b444ce19c7922476e2cd1e864d9bf56947d1b2ebd207cecab2a3392f3df8cfbbc67cabb46c218e6320eb8d7a262590fa207542daa098853721

  • SSDEEP

    768:1Kau5Zth5ux0XUtULLaFTt2TwomMrBWGYhyyQEQ2+RC6TIqv59z:YauBXkCanhcchyy7QBRC6TIqv59z

Score
10/10
evasionpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      1a247db9ae193938318c1935ebca3e258da2b1ba99902422066df28f4245a002

    • Size

      52KB

    • MD5

      19660b46a1d17197b4f9f77e0e8b2c58

    • SHA1

      ca057c6880fe2596193c64150d5f4d4b817be94e

    • SHA256

      1a247db9ae193938318c1935ebca3e258da2b1ba99902422066df28f4245a002

    • SHA512

      43614e6589d7c3b444ce19c7922476e2cd1e864d9bf56947d1b2ebd207cecab2a3392f3df8cfbbc67cabb46c218e6320eb8d7a262590fa207542daa098853721

    • SSDEEP

      768:1Kau5Zth5ux0XUtULLaFTt2TwomMrBWGYhyyQEQ2+RC6TIqv59z:YauBXkCanhcchyy7QBRC6TIqv59z

    Score
    10/10
    evasionransomwarespywarestealerpersistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks