Overview

overview

10

Static

static

3

заявк.exe

windows7-x64

10

заявк.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    заявк.rar

  • Size

    237KB

  • Sample

    230807-ha7jsadh96

  • MD5

    c704bc010db96fb239ea7cd0d0cbb137

  • SHA1

    35cf9d764d8ab38cdda3e2c6c9147947db816065

  • SHA256

    05afe90ae232227678223fd9c733567c7af155856284224e0e606fa634c42426

  • SHA512

    6044deb9cd9fd472ddf2d886d3837d514851b6ef1ea614122c4b23cfc7e8ac06f85739be3dd088610579c282a3590b42a209f7b4ac055d3ca39eb53f8f2e625d

  • SSDEEP

    6144:4WAdAea0sTwNz957Q89J/LO22MBCK2pncE:4WAdKjwNz91Vkjn/

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      заявк.exe

    • Size

      380KB

    • MD5

      cc159da1d464234347c4d9e7c0c8ee4c

    • SHA1

      fc2d07d3c0081e3ac1588796bb78abaefa43fb16

    • SHA256

      0455097f6c81a896542bc23f0d96c0193f15973af30ae70658c64d523adbab64

    • SHA512

      6386f807ffc2cdb67744821af2c4ac903997285ac3f2ac68de984a0a7654e32ec946bafd9e7721de1d00f2692b013f05be079609e938f0aafb8de5194c7c17cb

    • SSDEEP

      6144:LOYGXaPNxdgSdcq2pVZPOJHAbKWeW0vZE0zY0xGmdF9/YBk5T:fGqN/XdctpVtkml0vaX03/ikp

    Score
    10/10
    persistenceransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks