8d1df4ad2f67560f32c3550ff11ae14e14be72860e61b16aa8dd45749b16c38c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d1df4ad2f67560f32c3550ff11ae14e14be72860e61b16aa8dd45749b16c38c.sample
Size

126KB
Sample

240227-wdhaysfd72
MD5

eeed2c3a618054f4e55fa7e34df488ec
SHA1

882f0c868468d7941d3c6a6d363d6986d56f7dc2
SHA256

8d1df4ad2f67560f32c3550ff11ae14e14be72860e61b16aa8dd45749b16c38c
SHA512

01454808669f6fa06c493961da4f36e04059d0fbe20ce10ccef2cdc7d473199c79e5cc573229e02205643d0195bfe04325aeaab061600fe388fbcfdd61508b06
SSDEEP

3072:MsPYTh5hyfgRdUsKvLeB+OBmPOTqG+5TPeys9vhmlu:Mbh5Ms3sM+OmPZhl1Mmu

Score

7^/10

persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  8d1df4ad2f67560f32c3550ff11ae14e14be72860e61b16aa8dd45749b16c38c.sample
- Size
  
  126KB
- MD5
  
  eeed2c3a618054f4e55fa7e34df488ec
- SHA1
  
  882f0c868468d7941d3c6a6d363d6986d56f7dc2
- SHA256
  
  8d1df4ad2f67560f32c3550ff11ae14e14be72860e61b16aa8dd45749b16c38c
- SHA512
  
  01454808669f6fa06c493961da4f36e04059d0fbe20ce10ccef2cdc7d473199c79e5cc573229e02205643d0195bfe04325aeaab061600fe388fbcfdd61508b06
- SSDEEP
  
  3072:MsPYTh5hyfgRdUsKvLeB+OBmPOTqG+5TPeys9vhmlu:Mbh5Ms3sM+OmPZhl1Mmu
Score

7^/10

persistence ransomware spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

persistenceransomwarespywarestealer

behavioral2

persistenceransomwarespywarestealer