Overview

overview

10

Static

static

3

7a9636ed3c...a9.exe

windows7-x64

10

7a9636ed3c...a9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7a9636ed3c545f23b726b46c76724aa9

  • Size

    571KB

  • Sample

    240127-sqt9hagdgq

  • MD5

    7a9636ed3c545f23b726b46c76724aa9

  • SHA1

    abb89adfcf82cf14e4b2717c3ffc41ca8e51d49a

  • SHA256

    df2e69dfde1ff7ba4867a8f531238b24096ba1c16faf149c50e8d06a3b776a1c

  • SHA512

    dd74f0724e0684ad7deb60694cdd2323709a419b1160e0ac9485acde69f398b75d92b21c3b5d84a2cab45daedb4d2f9c29aeecc0f79d17a148f5e3f549daf7b4

  • SSDEEP

    6144:382p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYBwNG:Tp4pNfz3ymJnJ8QCFkxCaQTOlOb4

Score
10/10
persistenceransomware

Malware Config

Targets

    • Target

      7a9636ed3c545f23b726b46c76724aa9

    • Size

      571KB

    • MD5

      7a9636ed3c545f23b726b46c76724aa9

    • SHA1

      abb89adfcf82cf14e4b2717c3ffc41ca8e51d49a

    • SHA256

      df2e69dfde1ff7ba4867a8f531238b24096ba1c16faf149c50e8d06a3b776a1c

    • SHA512

      dd74f0724e0684ad7deb60694cdd2323709a419b1160e0ac9485acde69f398b75d92b21c3b5d84a2cab45daedb4d2f9c29aeecc0f79d17a148f5e3f549daf7b4

    • SSDEEP

      6144:382p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYBwNG:Tp4pNfz3ymJnJ8QCFkxCaQTOlOb4

    Score
    10/10
    persistenceransomware

    • Modifies WinLogon for persistence

      persistence

    • Renames multiple (91) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks