General
-
Target
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb
-
Size
50KB
-
Sample
231122-w6dhgaeg2s
-
MD5
1cebf0114b0d9d55a9be7e4448052033
-
SHA1
ae4b6043183c32466e3eccce346ebb2b53298a7e
-
SHA256
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb
-
SHA512
385c37b924bbeba706807e2f6bd023c8fc0ddb757ba8374b5a11eec1fd507ae0a9635fadbf1dd33d408ccd903247daa9b38c1eaa6224d133676885d7e187327d
-
SSDEEP
1536:IDOnfPe1Vfn332CUhMAB/TeduudGaOQQW1:0Ony3m5hjB/T0l1
Behavioral task
behavioral1
Sample
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb.exe
Resource
win10-20231023-en
Behavioral task
behavioral3
Sample
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win7-20231020-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
C:\Buy Black Mass Volume II.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\users\public\desktop\Buy Black Mass Volume II.hta
https://bazaar.abuse.ch/browse/
https://malshare.com/
Extracted
C:\Buy Black Mass Volume II.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Users\Admin\Desktop\Buy Black Mass Volume II.hta
https://bazaar.abuse.ch/browse/
https://malshare.com/
Extracted
C:\Buy Black Mass Volume II.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Extracted
C:\Buy Black Mass Volume II.hta
https://bazaar.abuse.ch/browse/
https://malshare.com/
Targets
-
-
Target
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb
-
Size
50KB
-
MD5
1cebf0114b0d9d55a9be7e4448052033
-
SHA1
ae4b6043183c32466e3eccce346ebb2b53298a7e
-
SHA256
763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb
-
SHA512
385c37b924bbeba706807e2f6bd023c8fc0ddb757ba8374b5a11eec1fd507ae0a9635fadbf1dd33d408ccd903247daa9b38c1eaa6224d133676885d7e187327d
-
SSDEEP
1536:IDOnfPe1Vfn332CUhMAB/TeduudGaOQQW1:0Ony3m5hjB/T0l1
-
Modifies boot configuration data using bcdedit
-
Renames multiple (308) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (448) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies Windows Firewall
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
-
-
Target
out.upx
-
Size
66KB
-
MD5
3e5cbdab7207e1a7ecd1bf16dce378f2
-
SHA1
909cc47b83d3f52ff1b442691030425998d00e13
-
SHA256
88e4f0f811954b60a885376a1f40cd3c5c3d9f1b8ffee6cda236b458b28b95ae
-
SHA512
e901ab9c82a00282440130c3a8d857a1f4d96dc7e340b4caefc78b684fd1c8c9e93515054c8820a91f43fcb156d9582ecf615dc6e2c0fbea4cf63ab50d426b2f
-
SSDEEP
1536:ANeRBl5PT/rx1mzwRMSTdLpY3G6+OjDSB0c4a+96tHUSc9u:AQRrmzwR5FLOiiVWH9c9
Score3/10 -
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1