Overview

overview

9

Static

static

1

14 الف ...ة.txt

windows11-21h2-x64

9

Resubmissions

05/03/2024, 20:00

240305-yq739aga3v 9

05/03/2024, 19:42

240305-yevc1sfd8v 6

05/03/2024, 19:37

240305-yb993afc7s 1

05/03/2024, 19:36

240305-ybajfafc31 1

05/03/2024, 19:33

240305-x9h3ssgb64 1

05/03/2024, 19:32

240305-x9bnqafb5w 1

05/03/2024, 19:32

240305-x84ywafb5s 3

05/03/2024, 19:29

240305-x7cs1afa7y 3

05/03/2024, 19:25

240305-x5bsxsga34 3

Sharing

Copy URL Twitter E-mail

General

  • Target

    14 الف طريقة.txt

  • Size

    429KB

  • Sample

    240305-yq739aga3v

  • MD5

    124e27f20c2eaf1aa34ba40f452d293d

  • SHA1

    357d796b9ec96ecaa1519abfa0ca19108c56d230

  • SHA256

    29bcc5b6c2170771e8976f1c898726e466a454f0dcff1b9bfa93f0077d168d1c

  • SHA512

    f47deb1de1d63e56185933a9a3cda1154b54db30af6fc7f331cdc67a468ddb589e1c1876b02bea8b3abd32c03a768c9d0e0011cfacb2b01ef41a24d40caa274b

  • SSDEEP

    6144:cKGKHKncAcscQXyXAYJI0CJEFdBgU8E0HZmFaqcscCHZmFaqcsc12jBgiGq9:yoiqyl

Score
9/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      14 الف طريقة.txt

    • Size

      429KB

    • MD5

      124e27f20c2eaf1aa34ba40f452d293d

    • SHA1

      357d796b9ec96ecaa1519abfa0ca19108c56d230

    • SHA256

      29bcc5b6c2170771e8976f1c898726e466a454f0dcff1b9bfa93f0077d168d1c

    • SHA512

      f47deb1de1d63e56185933a9a3cda1154b54db30af6fc7f331cdc67a468ddb589e1c1876b02bea8b3abd32c03a768c9d0e0011cfacb2b01ef41a24d40caa274b

    • SSDEEP

      6144:cKGKHKncAcscQXyXAYJI0CJEFdBgU8E0HZmFaqcscCHZmFaqcsc12jBgiGq9:yoiqyl

    Score
    9/10
    discoverypersistenceransomware

    • Renames multiple (124) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks