Overview

overview

9

Static

static

1

04edfb7f28...53.exe

windows7-x64

9

04edfb7f28...53.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04edfb7f28e85eb9bdefd63e81c37753.exe

  • Size

    294KB

  • Sample

    230302-3kz8nsfd38

  • MD5

    04edfb7f28e85eb9bdefd63e81c37753

  • SHA1

    9ea3665e662fd22ccb6d8d977ad5abd6bc806631

  • SHA256

    d7e985fabb6a936c59f36c0b717aaae6c32df05688c0673fcbc677bb88b10ff5

  • SHA512

    9b30b9b5a8e0075b5954db5c5fc52498ae47e89b8003058788e22cdf12974a8f471b3a9816ee6a73a07680238dd7cb9d5463241ddf64aa8dfef1ccb658404a92

  • SSDEEP

    6144:39/dAPMFn4d1fX1GnZx7cAOIBiFNTqkal06jaU2TTUhaRW:t/dAEFnMXmcA2NTqka06j8/FW

Score
9/10
ransomware

Malware Config

Targets

    • Target

      04edfb7f28e85eb9bdefd63e81c37753.exe

    • Size

      294KB

    • MD5

      04edfb7f28e85eb9bdefd63e81c37753

    • SHA1

      9ea3665e662fd22ccb6d8d977ad5abd6bc806631

    • SHA256

      d7e985fabb6a936c59f36c0b717aaae6c32df05688c0673fcbc677bb88b10ff5

    • SHA512

      9b30b9b5a8e0075b5954db5c5fc52498ae47e89b8003058788e22cdf12974a8f471b3a9816ee6a73a07680238dd7cb9d5463241ddf64aa8dfef1ccb658404a92

    • SSDEEP

      6144:39/dAPMFn4d1fX1GnZx7cAOIBiFNTqkal06jaU2TTUhaRW:t/dAEFnMXmcA2NTqka06j8/FW

    Score
    9/10
    ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks