483e0e32d3be3d2e585463aa7475c8b8ce254900bacfb9a546a5318fff024b74 | Triage

Resubmissions

31/03/2024, 07:20

240331-h5425sfh6t 10

14/01/2024, 09:31

240114-lg9t9sfgfj 9

Sharing

General

Target

483e0e32d3be3d2e585463aa7475c8b8ce254900bacfb9a546a5318fff024b74
Size

974KB
Sample

240114-lg9t9sfgfj
MD5

45d20637261dea248644a849818659a0
SHA1

29a81b7cf0f5f4a69fe47c4ccf3d06a300899997
SHA256

483e0e32d3be3d2e585463aa7475c8b8ce254900bacfb9a546a5318fff024b74
SHA512

a9c935eb23fba99ba74299db7b8ac3a158183d9fe9ccaaa87e8a1b9d39c518d223563378d981e6bf386f058b159609fb42e14ca45c023f7688ca57e0c61d2519
SSDEEP

12288:fFDF/UI+c+xTOQUMnufZUgxXu/VzcccSCO4lkAjx9h/MR1V:fjnb+OQUMnufZ+tzcccSCO6ke3/Mf

Score

9^/10

evasion ransomware spyware stealer

Malware Config

Targets

- Target
  
  483e0e32d3be3d2e585463aa7475c8b8ce254900bacfb9a546a5318fff024b74
- Size
  
  974KB
- MD5
  
  45d20637261dea248644a849818659a0
- SHA1
  
  29a81b7cf0f5f4a69fe47c4ccf3d06a300899997
- SHA256
  
  483e0e32d3be3d2e585463aa7475c8b8ce254900bacfb9a546a5318fff024b74
- SHA512
  
  a9c935eb23fba99ba74299db7b8ac3a158183d9fe9ccaaa87e8a1b9d39c518d223563378d981e6bf386f058b159609fb42e14ca45c023f7688ca57e0c61d2519
- SSDEEP
  
  12288:fFDF/UI+c+xTOQUMnufZUgxXu/VzcccSCO4lkAjx9h/MR1V:fjnb+OQUMnufZ+tzcccSCO6ke3/Mf
Score

9^/10

evasion ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (139) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  evasion
- Stops running service(s)
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

evasionransomwarespywarestealer

behavioral2

evasionransomwarespywarestealer