General
-
Target
ff230f8ca501e06feedd202b40879e2b.exe
-
Size
295KB
-
Sample
231012-t9pc2aca8x
-
MD5
ff230f8ca501e06feedd202b40879e2b
-
SHA1
6ffb1e4af21e5413b07d0b4951f2dfaaba6b26b0
-
SHA256
9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1
-
SHA512
308edf14261f3763fe3bb65cef4b88473b91d02b032441d91cc87a9a49d7b20df381bae28eae7ded49cfca529bfe11da40d2f4ac2fa9c6495e6527604ca2d800
-
SSDEEP
6144:ugyOoVGyCNHIbER9bbDHyzJxE5zPYS5ycCE+WQnaTzQNeqR0R:ugyr3CNHIbeym3FCEnYeq
Static task
static1
Behavioral task
behavioral1
Sample
ff230f8ca501e06feedd202b40879e2b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ff230f8ca501e06feedd202b40879e2b.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\users\public\desktop\info.hta
Targets
-
-
Target
ff230f8ca501e06feedd202b40879e2b.exe
-
Size
295KB
-
MD5
ff230f8ca501e06feedd202b40879e2b
-
SHA1
6ffb1e4af21e5413b07d0b4951f2dfaaba6b26b0
-
SHA256
9f40b69060a52731107baec84a0c0f8a1bfc1a62e8471b9cd69509aade9cb7f1
-
SHA512
308edf14261f3763fe3bb65cef4b88473b91d02b032441d91cc87a9a49d7b20df381bae28eae7ded49cfca529bfe11da40d2f4ac2fa9c6495e6527604ca2d800
-
SSDEEP
6144:ugyOoVGyCNHIbER9bbDHyzJxE5zPYS5ycCE+WQnaTzQNeqR0R:ugyr3CNHIbeym3FCEnYeq
Score10/10-
Modifies boot configuration data using bcdedit
-
Renames multiple (290) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (594) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1