Overview

overview

9

Static

static

3

f4f16132ca...JC.exe

windows7-x64

9

f4f16132ca...JC.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    f4f16132ca4704exe_JC.exe

  • Size

    131KB

  • Sample

    230719-s2x5jahd37

  • MD5

    f4f16132ca4704cc3ef881b2c136ee25

  • SHA1

    33ff60ab4aec6f04f6ff204cd1e0dc86db7d5e07

  • SHA256

    5457e36971779555fc051dbf6969871394fc3c772027a985060b2c4242bc642a

  • SHA512

    b8ae47631905b19b950e4c82b0f2a8249b17b7773b4dfb14ea4752343568ad9e92addeb9af6c79742fb41d8b0c4a76d540d2de333f256374fed077b182f1eda5

  • SSDEEP

    3072:wxb4zdcTtDRgqoru/Go5rWIy4m3WV1oqCgQfBUnPy8L2VBBh:w+OTttgxre1Q4m3WV1oqCgQfBUPy8L2L

Score
9/10
persistenceransomware

Malware Config

Targets

    • Target

      f4f16132ca4704exe_JC.exe

    • Size

      131KB

    • MD5

      f4f16132ca4704cc3ef881b2c136ee25

    • SHA1

      33ff60ab4aec6f04f6ff204cd1e0dc86db7d5e07

    • SHA256

      5457e36971779555fc051dbf6969871394fc3c772027a985060b2c4242bc642a

    • SHA512

      b8ae47631905b19b950e4c82b0f2a8249b17b7773b4dfb14ea4752343568ad9e92addeb9af6c79742fb41d8b0c4a76d540d2de333f256374fed077b182f1eda5

    • SSDEEP

      3072:wxb4zdcTtDRgqoru/Go5rWIy4m3WV1oqCgQfBUnPy8L2VBBh:w+OTttgxre1Q4m3WV1oqCgQfBUPy8L2L

    Score
    9/10
    persistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks