Overview

overview

9

Static

static

1

FiveM (1).exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FiveM (1).exe

  • Size

    5.0MB

  • Sample

    240417-sfxlwaeg8v

  • MD5

    e8c3fd1b35507fa301fac9367f28757f

  • SHA1

    fd03919c9370248a62c9d540f6cd9fbeccac09f6

  • SHA256

    05a99a0067ddde35a8b6c92721fc8ee058ffe1cee9a9dceb2bafb1a8e2d92368

  • SHA512

    7f4f60aa0978a5f3f49cac744c11b6fe410cf32ec8dcd83fd6ad2120e9830b242b6f6a758c03ca76e8ffa800dbfec1b92f759c176f829f94492ed81e65befcdd

  • SSDEEP

    49152:XOjPWFWnM4r0BEjYoVKs0B6N58NaUjwg1mxE9tOjhhVmaeI84dhAzBM04arJYLaw:iMKk0N5f/rQcc9YL4P1G/Lzg5ji13

Score
9/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      FiveM (1).exe

    • Size

      5.0MB

    • MD5

      e8c3fd1b35507fa301fac9367f28757f

    • SHA1

      fd03919c9370248a62c9d540f6cd9fbeccac09f6

    • SHA256

      05a99a0067ddde35a8b6c92721fc8ee058ffe1cee9a9dceb2bafb1a8e2d92368

    • SHA512

      7f4f60aa0978a5f3f49cac744c11b6fe410cf32ec8dcd83fd6ad2120e9830b242b6f6a758c03ca76e8ffa800dbfec1b92f759c176f829f94492ed81e65befcdd

    • SSDEEP

      49152:XOjPWFWnM4r0BEjYoVKs0B6N58NaUjwg1mxE9tOjhhVmaeI84dhAzBM04arJYLaw:iMKk0N5f/rQcc9YL4P1G/Lzg5ji13

    Score
    9/10
    discoverypersistenceransomware

    • Renames multiple (125) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks