Overview

overview

8

Static

static

7

06230999.exe

windows7-x64

06230999.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    06230999.exe

  • Size

    1.2MB

  • Sample

    230609-hnpacsbb89

  • MD5

    e0340f456f76993fc047bc715dfdae6a

  • SHA1

    d47f6f7e553c4bc44a2fe88c2054de901390b2d7

  • SHA256

    1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887

  • SHA512

    cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc

  • SSDEEP

    24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG

Score
8/10
bootkitpersistenceransomwareupx

Malware Config

Targets

    • Target

      06230999.exe

    • Size

      1.2MB

    • MD5

      e0340f456f76993fc047bc715dfdae6a

    • SHA1

      d47f6f7e553c4bc44a2fe88c2054de901390b2d7

    • SHA256

      1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887

    • SHA512

      cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc

    • SSDEEP

      24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG

    Score
    8/10
    bootkitpersistenceransomwareupx

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks