General
-
Target
7e7efe8fd3996c97f54c32b1e77c73151c01cad00075a10eacdeb27306d1366c
-
Size
117KB
-
Sample
240424-3m5aeabf86
-
MD5
55b4323e5c127884a5feac1866bbaaf7
-
SHA1
3851fb1d0b229a87b3894b3771839d502e40c711
-
SHA256
7e7efe8fd3996c97f54c32b1e77c73151c01cad00075a10eacdeb27306d1366c
-
SHA512
c5933f139a0636446d6322c7d88df2bd90c72116752f896ee4e23a8c7f5ad7fef39d4f21030ca705fcfbd8cdae710ae14650ece9caac86fd5563bd655454db4c
-
SSDEEP
3072:upaSMM0+p5vkNRJ7vRVc1ASnUixrqSL/uEn9r:upFMM5MdOASnUiUguE
Static task
static1
Behavioral task
behavioral1
Sample
7e7efe8fd3996c97f54c32b1e77c73151c01cad00075a10eacdeb27306d1366c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7e7efe8fd3996c97f54c32b1e77c73151c01cad00075a10eacdeb27306d1366c.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
7e7efe8fd3996c97f54c32b1e77c73151c01cad00075a10eacdeb27306d1366c
-
Size
117KB
-
MD5
55b4323e5c127884a5feac1866bbaaf7
-
SHA1
3851fb1d0b229a87b3894b3771839d502e40c711
-
SHA256
7e7efe8fd3996c97f54c32b1e77c73151c01cad00075a10eacdeb27306d1366c
-
SHA512
c5933f139a0636446d6322c7d88df2bd90c72116752f896ee4e23a8c7f5ad7fef39d4f21030ca705fcfbd8cdae710ae14650ece9caac86fd5563bd655454db4c
-
SSDEEP
3072:upaSMM0+p5vkNRJ7vRVc1ASnUixrqSL/uEn9r:upFMM5MdOASnUiUguE
Score10/10-
Modifies visibility of file extensions in Explorer
-
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1