Overview

overview

9

Static

static

1

944927ddcf...0d.vbs

windows7-x64

6

944927ddcf...0d.vbs

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    944927ddcf8c65de34269cfdc8112b1c2e20dc64670d384b908951003b73000d

  • Size

    7KB

  • Sample

    240202-12n6mabcdq

  • MD5

    4c2b4d6277d92e554ae1369a8a4b68e2

  • SHA1

    a4acf79a83a7d10d3a7039e5eec890395e0e7370

  • SHA256

    944927ddcf8c65de34269cfdc8112b1c2e20dc64670d384b908951003b73000d

  • SHA512

    99c934bc4e43c5a001c24715af6702e591ca4af4ae6e2a45e60bb9c9b0357028759f909da95b5ab35712dfe7ed943fc476a4f0c94c7b880cbad93b426902cda9

  • SSDEEP

    96:gAJpoQaf1RL5iRSIqK+vYLulSoNr5bAiq+hhfeYF/dByOIARVOEAII6jzbajp02H:tfCia5RqMTeYF/dBXI62Smb

Score
9/10
persistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      944927ddcf8c65de34269cfdc8112b1c2e20dc64670d384b908951003b73000d

    • Size

      7KB

    • MD5

      4c2b4d6277d92e554ae1369a8a4b68e2

    • SHA1

      a4acf79a83a7d10d3a7039e5eec890395e0e7370

    • SHA256

      944927ddcf8c65de34269cfdc8112b1c2e20dc64670d384b908951003b73000d

    • SHA512

      99c934bc4e43c5a001c24715af6702e591ca4af4ae6e2a45e60bb9c9b0357028759f909da95b5ab35712dfe7ed943fc476a4f0c94c7b880cbad93b426902cda9

    • SSDEEP

      96:gAJpoQaf1RL5iRSIqK+vYLulSoNr5bAiq+hhfeYF/dByOIARVOEAII6jzbajp02H:tfCia5RqMTeYF/dBXI62Smb

    Score
    9/10
    persistenceransomwarespywarestealer

    • Renames multiple (415) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks