Overview

overview

10

Static

static

1

sample.html

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    sample

  • Size

    20KB

  • Sample

    240503-wpbbsacd4s

  • MD5

    61d5c30247c44511543dd943c4f5354a

  • SHA1

    995064c6a682d27224cfaf0a9880dc3bd8daf0af

  • SHA256

    e3599f54f097ae9350f4dfb3e1998d53447ee47f85e900f7f61884c0299333eb

  • SHA512

    94ad4b2a357690fb98763e5ed0eede57d109d30af09c3142e1e81d8ec7abdab241a724c975e65aa79bf06e5938a01c49bce2f2983c74d30f83268d2fed12a49c

  • SSDEEP

    384:rRuazhgDpmReVoOs4Oi9ylKeGMOU8HhhbKVgY7HS2LjMrSD+8IJCgMmVn:rQBVoOs4OmyI1MkBhbiNXMrS2J2mVn

Score
10/10
evasionpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      sample

    • Size

      20KB

    • MD5

      61d5c30247c44511543dd943c4f5354a

    • SHA1

      995064c6a682d27224cfaf0a9880dc3bd8daf0af

    • SHA256

      e3599f54f097ae9350f4dfb3e1998d53447ee47f85e900f7f61884c0299333eb

    • SHA512

      94ad4b2a357690fb98763e5ed0eede57d109d30af09c3142e1e81d8ec7abdab241a724c975e65aa79bf06e5938a01c49bce2f2983c74d30f83268d2fed12a49c

    • SSDEEP

      384:rRuazhgDpmReVoOs4Oi9ylKeGMOU8HhhbKVgY7HS2LjMrSD+8IJCgMmVn:rQBVoOs4OmyI1MkBhbiNXMrS2J2mVn

    Score
    10/10
    evasionpersistenceransomwaretrojanupx

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks