Overview

overview

9

Static

static

3

a864282fea...c6.exe

windows7-x64

9

a864282fea...c6.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6

  • Size

    1.2MB

  • Sample

    230628-prmdhahe25

  • MD5

    0c8e88877383ccd23a755f429006b437

  • SHA1

    69b3d913a3967153d1e91ba1a31ebed839b297ed

  • SHA256

    a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6

  • SHA512

    ba5296a84b7107b293d1afd4752157edaa1a3f1059685ecad2ddea9b9221ee9c8092ce5cae6f2f6a4866e25ca0bf66dd3fbc0786b2a26cb708d2cd536dd85041

  • SSDEEP

    24576:utP7hdO1s6Skscec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:gLO1qkscec0gnyN9HPFCCNSI6GOfaFVp

Score
9/10
ransomwarespywarestealer

Malware Config

Targets

    • Target

      a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6

    • Size

      1.2MB

    • MD5

      0c8e88877383ccd23a755f429006b437

    • SHA1

      69b3d913a3967153d1e91ba1a31ebed839b297ed

    • SHA256

      a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6

    • SHA512

      ba5296a84b7107b293d1afd4752157edaa1a3f1059685ecad2ddea9b9221ee9c8092ce5cae6f2f6a4866e25ca0bf66dd3fbc0786b2a26cb708d2cd536dd85041

    • SSDEEP

      24576:utP7hdO1s6Skscec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:gLO1qkscec0gnyN9HPFCCNSI6GOfaFVp

    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (1560) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Renames multiple (604) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks