Overview

overview

10

Static

static

3

5357555a36...3a.exe

windows7-x64

10

5357555a36...3a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5357555a362d46343601b6b9dc6fa33a

  • Size

    939KB

  • Sample

    240111-m4y7qaeeer

  • MD5

    5357555a362d46343601b6b9dc6fa33a

  • SHA1

    b66a013a7485290bed5d5df3fe80fc45c22cd4e6

  • SHA256

    c0ce4187cd5edd6933c3f33ec59b5c27aec6d846d30fa0f2777c1900a783767b

  • SHA512

    102b8811babfe97485cfc6afea4fbdd523bc1d37c5dafc5cd2d385d8985c888a2fc78af5ac9ba17281266a9316e53a8efde24062282ef9bbd3a933f5cba35254

  • SSDEEP

    12288:gp4pNfz3ymJnJ8QCFkxCaQTOl2GVqCw+57U:aEtl9mRda1VICwWw

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      5357555a362d46343601b6b9dc6fa33a

    • Size

      939KB

    • MD5

      5357555a362d46343601b6b9dc6fa33a

    • SHA1

      b66a013a7485290bed5d5df3fe80fc45c22cd4e6

    • SHA256

      c0ce4187cd5edd6933c3f33ec59b5c27aec6d846d30fa0f2777c1900a783767b

    • SHA512

      102b8811babfe97485cfc6afea4fbdd523bc1d37c5dafc5cd2d385d8985c888a2fc78af5ac9ba17281266a9316e53a8efde24062282ef9bbd3a933f5cba35254

    • SSDEEP

      12288:gp4pNfz3ymJnJ8QCFkxCaQTOl2GVqCw+57U:aEtl9mRda1VICwWw

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks