General
-
Target
7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7eexe_JC.exe
-
Size
56KB
-
Sample
231005-vsq1zafa83
-
MD5
9eafe0c48ea68ccb1da722b5bc36fa8c
-
SHA1
d598a96f482c4e5412baf5723b5a53f5930f0126
-
SHA256
7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7e
-
SHA512
73f8835c487fb0007775a5696b41369721da150b6e8aa1b442d5b9bab6c46255c4d0ef9c5e1ea1c0547586866d026a9006a2d5c39e8a42afe634cb9c67512a75
-
SSDEEP
768:NvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1E3WUrXzM+W5I+:vNeRBl5PT/rx1mzwRMSTdLpJ3o2zEt
Static task
static1
Behavioral task
behavioral1
Sample
7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7eexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7eexe_JC.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
C:\info.hta
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\users\public\desktop\info.hta
Targets
-
-
Target
7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7eexe_JC.exe
-
Size
56KB
-
MD5
9eafe0c48ea68ccb1da722b5bc36fa8c
-
SHA1
d598a96f482c4e5412baf5723b5a53f5930f0126
-
SHA256
7124f6f197e503f77b3bbb136391b12d79a0e248e697506184aaf19b2df8eb7e
-
SHA512
73f8835c487fb0007775a5696b41369721da150b6e8aa1b442d5b9bab6c46255c4d0ef9c5e1ea1c0547586866d026a9006a2d5c39e8a42afe634cb9c67512a75
-
SSDEEP
768:NvrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1E3WUrXzM+W5I+:vNeRBl5PT/rx1mzwRMSTdLpJ3o2zEt
Score10/10-
Modifies boot configuration data using bcdedit
-
Renames multiple (306) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1