Overview

overview

10

Static

static

3

8f699f3b24...ex.exe

windows7-x64

10

8f699f3b24...ex.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8f699f3b246bedexeexeexeex.exe

  • Size

    188KB

  • Sample

    230709-sfyh6sdf56

  • MD5

    8f699f3b246bedc6109fc369e3e9f794

  • SHA1

    6f1d13e282e9e33f8fa797805bcf2c90f89a58a3

  • SHA256

    4f5c81ea2bd61882bc706330310c8e0892801c20f43aa978ccbe429140c35dea

  • SHA512

    47fc6382586ff0cb7510a6b0ab4f6f99045bda99a07b973946c6506878a603ae1306ed6cf9b9d575a45f6ab2ef34d4e960a54552b11b5ddf43646ae2e2c47172

  • SSDEEP

    3072:VHgQt/I3iKtYGCQHFAEiIZgP/oFXMOQ2xk2yb0iBT6F:VPtg3iGCWiIPXMOQ10uTe

Score
10/10
evasionpersistenceransomwarespywarestealertrojan

Malware Config

Targets

    • Target

      8f699f3b246bedexeexeexeex.exe

    • Size

      188KB

    • MD5

      8f699f3b246bedc6109fc369e3e9f794

    • SHA1

      6f1d13e282e9e33f8fa797805bcf2c90f89a58a3

    • SHA256

      4f5c81ea2bd61882bc706330310c8e0892801c20f43aa978ccbe429140c35dea

    • SHA512

      47fc6382586ff0cb7510a6b0ab4f6f99045bda99a07b973946c6506878a603ae1306ed6cf9b9d575a45f6ab2ef34d4e960a54552b11b5ddf43646ae2e2c47172

    • SSDEEP

      3072:VHgQt/I3iKtYGCQHFAEiIZgP/oFXMOQ2xk2yb0iBT6F:VPtg3iGCWiIPXMOQ10uTe

    Score
    10/10
    evasionpersistenceransomwarespywarestealertrojan

    • Modifies visibility of file extensions in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks