Overview

overview

10

Static

static

10

67219f4321...8e.exe

windows7-x64

9

67219f4321...8e.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67219f43217d5aec3332a3f999e4b2a18c989751b79881a71438aa63fb21d28e.bin

  • Size

    368KB

  • Sample

    240329-d5bclsgf9z

  • MD5

    4fc21019958f322932f513de035099a1

  • SHA1

    9e74b111726016a375ff1f5c5d496196055957ca

  • SHA256

    67219f43217d5aec3332a3f999e4b2a18c989751b79881a71438aa63fb21d28e

  • SHA512

    cc0a858d16633bf79446fae79d251c85d547825fe6f563bbe4fe2bd57f1b6a6749ce1b29112bba8f56a483f2c133e6fd74473eade9be98980307b6baf825aba1

  • SSDEEP

    3072:804bp8PrsMN3lVX4D2Yy2JAAG1kaZMP6VcJGbpQLfKYWVYGjhTPt+rjoM:8HbirsM3l+2wmk9P2nbpuff4Wjb

Score
10/10
persistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      67219f43217d5aec3332a3f999e4b2a18c989751b79881a71438aa63fb21d28e.bin

    • Size

      368KB

    • MD5

      4fc21019958f322932f513de035099a1

    • SHA1

      9e74b111726016a375ff1f5c5d496196055957ca

    • SHA256

      67219f43217d5aec3332a3f999e4b2a18c989751b79881a71438aa63fb21d28e

    • SHA512

      cc0a858d16633bf79446fae79d251c85d547825fe6f563bbe4fe2bd57f1b6a6749ce1b29112bba8f56a483f2c133e6fd74473eade9be98980307b6baf825aba1

    • SSDEEP

      3072:804bp8PrsMN3lVX4D2Yy2JAAG1kaZMP6VcJGbpQLfKYWVYGjhTPt+rjoM:8HbirsM3l+2wmk9P2nbpuff4Wjb

    Score
    9/10
    persistenceransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Detects ransomware indicator

    • Renames multiple (732) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks