Overview

overview

10

Static

static

10

735de985bc...d9.exe

windows7-x64

9

735de985bc...d9.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    735de985bcac7162d645909a350007f66a9f2ba20464bd69f5d3b0e78de1fdd9.exe

  • Size

    216KB

  • Sample

    240128-3mxwbsdbd8

  • MD5

    1e91667e17b77f647cc18f1e6bd6cc23

  • SHA1

    07c7662bd89333c9bd74cb94c000db2e66b3fe1f

  • SHA256

    a8d9980916971305fbf9d1aed172bd3c2a2b5a4f91aacaabbe161185f00e93c5

  • SHA512

    2af2e93151fc72bdca88d2cbfe69d7f94832abdc9240693ede2a4cd768b195fc99621f8cad7ac1c64e52699ccdd9263e997b7561c634c0ba25e7860f24a5c15d

  • SSDEEP

    3072:m17DaAz38w3vL7F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Gb82F6Pf2KQ+aVB2fJqh4Id

Score
10/10
ransomware

Malware Config

Targets

    • Target

      735de985bcac7162d645909a350007f66a9f2ba20464bd69f5d3b0e78de1fdd9.exe

    • Size

      216KB

    • MD5

      1e91667e17b77f647cc18f1e6bd6cc23

    • SHA1

      07c7662bd89333c9bd74cb94c000db2e66b3fe1f

    • SHA256

      a8d9980916971305fbf9d1aed172bd3c2a2b5a4f91aacaabbe161185f00e93c5

    • SHA512

      2af2e93151fc72bdca88d2cbfe69d7f94832abdc9240693ede2a4cd768b195fc99621f8cad7ac1c64e52699ccdd9263e997b7561c634c0ba25e7860f24a5c15d

    • SSDEEP

      3072:m17DaAz38w3vL7F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Gb82F6Pf2KQ+aVB2fJqh4Id

    Score
    9/10
    ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (299) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies boot configuration data using bcdedit

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks