General

  • Target

    Ransomware-Maker.cs.zip

  • Size

    455KB

  • Sample

    231014-ldke7sbf3t

  • MD5

    03039bee088196b3c46134e888cee3c0

  • SHA1

    3fd9b5fb1a05adb6e57642e0a76dd7a669b8598e

  • SHA256

    9bb588b130ff65c2625be1c993b1c47be61071bf671d2222b04091601f65ec87

  • SHA512

    df2a69a8f41a693b3799cab69eff6c45e58191cf83b3aa2edd2bbc1753fa247141e1e8a8fc141ff503bd35cfe325fbe26b81a78a732f41fa59e23a1a865cd371

  • SSDEEP

    12288:zr4bI9kzYPBLLyI4YUGIvNt8tgkzYttIgBbxcWG4oLSeW1/htl0dy:zoIeYByVQY/BF+LchHGy

Malware Config

Targets

    • Target

      Ransomware-Maker.cs.zip

    • Size

      455KB

    • MD5

      03039bee088196b3c46134e888cee3c0

    • SHA1

      3fd9b5fb1a05adb6e57642e0a76dd7a669b8598e

    • SHA256

      9bb588b130ff65c2625be1c993b1c47be61071bf671d2222b04091601f65ec87

    • SHA512

      df2a69a8f41a693b3799cab69eff6c45e58191cf83b3aa2edd2bbc1753fa247141e1e8a8fc141ff503bd35cfe325fbe26b81a78a732f41fa59e23a1a865cd371

    • SSDEEP

      12288:zr4bI9kzYPBLLyI4YUGIvNt8tgkzYttIgBbxcWG4oLSeW1/htl0dy:zoIeYByVQY/BF+LchHGy

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks