Overview

overview

10

Static

static

1

ddd26bc522...6e.exe

windows7-x64

10

ddd26bc522...6e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddd26bc522e7746199f18403db868603df9a3df54ebfca4ad85e716bca363d6e

  • Size

    445KB

  • Sample

    231207-sfz21acd54

  • MD5

    9716d8484fa0d312eed429e9e3ef9a9f

  • SHA1

    a05bd7e34f180cd59a8541eb924dfdb0855a71aa

  • SHA256

    ddd26bc522e7746199f18403db868603df9a3df54ebfca4ad85e716bca363d6e

  • SHA512

    a51b7cd04f256728775f6ea6a599135894dcd75b1b5af91970b975feca0571d59b9b60d8d1ca2f3434d39ca81f3dbabf1197ee1ce97b4d84a19518f1d0d5f078

  • SSDEEP

    6144:vOYGXaPNxdgSdcq2pVZPOJHAbK/KSQxolkLIQAL9bpZgBJDEFdkYn8:jGqN/XdctpVtkPKfolkLPAL998EQY8

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      ddd26bc522e7746199f18403db868603df9a3df54ebfca4ad85e716bca363d6e

    • Size

      445KB

    • MD5

      9716d8484fa0d312eed429e9e3ef9a9f

    • SHA1

      a05bd7e34f180cd59a8541eb924dfdb0855a71aa

    • SHA256

      ddd26bc522e7746199f18403db868603df9a3df54ebfca4ad85e716bca363d6e

    • SHA512

      a51b7cd04f256728775f6ea6a599135894dcd75b1b5af91970b975feca0571d59b9b60d8d1ca2f3434d39ca81f3dbabf1197ee1ce97b4d84a19518f1d0d5f078

    • SSDEEP

      6144:vOYGXaPNxdgSdcq2pVZPOJHAbK/KSQxolkLIQAL9bpZgBJDEFdkYn8:jGqN/XdctpVtkPKfolkLPAL998EQY8

    Score
    10/10
    persistenceransomware

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Resource Development

Reconnaissance

Tasks