General
-
Target
2cfd30a7982b90be60f83fe5f4132999ac50d0d63d9681d8d50c3c8271faa34b
-
Size
782KB
-
Sample
231009-jlg9psde62
-
MD5
226c69fbd80993cd5f17f696aa924bcb
-
SHA1
1aa0bf6a2470de52934be70d329a3e80e00fbd0b
-
SHA256
2cfd30a7982b90be60f83fe5f4132999ac50d0d63d9681d8d50c3c8271faa34b
-
SHA512
cf55ad1be4e88305b33cc48385c1f3e0581bbcc89a6f679b3905205fe55bea21c814dd13736e0cd9a4873757ebd8c0359a70e02df2fd6ef67415a3b76b70ebaf
-
SSDEEP
12288:nhnPdo71+rsm5svWgNt6pAes0MiwLg2kLpkXfrfaEyC6gG5kmtcM0JIM1EdMEAL1:58ism5svWgufpkXfrfaEH07YIO0aL0w
Static task
static1
Behavioral task
behavioral1
Sample
2cfd30a7982b90be60f83fe5f4132999ac50d0d63d9681d8d50c3c8271faa34b.exe
Resource
win10-20230915-en
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Users\Admin\Desktop\info.hta
Targets
-
-
Target
2cfd30a7982b90be60f83fe5f4132999ac50d0d63d9681d8d50c3c8271faa34b
-
Size
782KB
-
MD5
226c69fbd80993cd5f17f696aa924bcb
-
SHA1
1aa0bf6a2470de52934be70d329a3e80e00fbd0b
-
SHA256
2cfd30a7982b90be60f83fe5f4132999ac50d0d63d9681d8d50c3c8271faa34b
-
SHA512
cf55ad1be4e88305b33cc48385c1f3e0581bbcc89a6f679b3905205fe55bea21c814dd13736e0cd9a4873757ebd8c0359a70e02df2fd6ef67415a3b76b70ebaf
-
SSDEEP
12288:nhnPdo71+rsm5svWgNt6pAes0MiwLg2kLpkXfrfaEyC6gG5kmtcM0JIM1EdMEAL1:58ism5svWgufpkXfrfaEH07YIO0aL0w
Score10/10-
Modifies boot configuration data using bcdedit
-
Renames multiple (451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1