27ebd2d00726ee12b45299240442c82c1274241eaf7c99645e1538bec5da05ae | Triage

Submit
Reports

Overview

overview

Static

static

7

778a328cc3...f2.exe

windows7-x64

778a328cc3...f2.exe

windows10-2004-x64

Sharing

General

Target

778a328cc3859c1d26bf89253d76d9f2
Size

10.8MB
Sample

240126-q8m7ssgehl
MD5

778a328cc3859c1d26bf89253d76d9f2
SHA1

bba3eaecf83c96ab2de719ef1b84209f2d2afb20
SHA256

27ebd2d00726ee12b45299240442c82c1274241eaf7c99645e1538bec5da05ae
SHA512

c8d26a4f817c27eece6daa5e68579397d9c6e9f3ea2e5c16d2db6ebff810858cdb97f4d1c5c563fb3e2fdbefcceeed08d28b94b9c65fc11f8f64fc36993d7d03
SSDEEP

196608:p7G4BFifYizLQ8uGdbwRLTvICzcHWrUDZNEY20EK5pNDOIXKtThkn4L4aGaMeBNy:047ccGbAhcSKUi0t44BN8eGeq

Score

10^/10

evasion ransomware upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

778a328cc3859c1d26bf89253d76d9f2.exe

Resource

win7-20231129-en

evasion ransomware upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

778a328cc3859c1d26bf89253d76d9f2.exe

Resource

win10v2004-20231222-en

evasion ransomware upx

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  778a328cc3859c1d26bf89253d76d9f2
- Size
  
  10.8MB
- MD5
  
  778a328cc3859c1d26bf89253d76d9f2
- SHA1
  
  bba3eaecf83c96ab2de719ef1b84209f2d2afb20
- SHA256
  
  27ebd2d00726ee12b45299240442c82c1274241eaf7c99645e1538bec5da05ae
- SHA512
  
  c8d26a4f817c27eece6daa5e68579397d9c6e9f3ea2e5c16d2db6ebff810858cdb97f4d1c5c563fb3e2fdbefcceeed08d28b94b9c65fc11f8f64fc36993d7d03
- SSDEEP
  
  196608:p7G4BFifYizLQ8uGdbwRLTvICzcHWrUDZNEY20EK5pNDOIXKtThkn4L4aGaMeBNy:047ccGbAhcSKUi0t44BN8eGeq
Score

10^/10

evasion ransomware upx
- Deletes NTFS Change Journal
  The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
  ransomware
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables use of System Restore points
  evasion
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Data Destruction

Inhibit System Recovery

Tasks

static1

behavioral1

evasionransomwareupx

behavioral2

evasionransomwareupx

© 2018-2025

Terms | Privacy