8c9a9e2dbd989b305b55eb0eb7ab418dfa647d9c2c1bd87cdee4fa4e8a14ff83 | Triage

Resubmissions

09/05/2024, 16:46

240509-t9755scb3w 8

09/05/2024, 16:43

240509-t8g8bsca3v 9

Sharing

General

Target

MalTrade.html
Size

1KB
Sample

240509-t8g8bsca3v
MD5

078d900d32e42eecf4d2f6be6c603523
SHA1

5788502989ef5cc8800f25b535102d81e83952b6
SHA256

8c9a9e2dbd989b305b55eb0eb7ab418dfa647d9c2c1bd87cdee4fa4e8a14ff83
SHA512

0f3d254faf443a773dc74e8bbf2eb46bbdf3e6d3d1437402e7b1713bbb1cf6e0f92d7c7aada8b1270d4f9a65f7aadbe1b59bde7b015330947c4d90a89389133c

Score

9^/10

evasion execution pyinstaller ransomware

Malware Config

Targets

- Target
  
  MalTrade.html
- Size
  
  1KB
- MD5
  
  078d900d32e42eecf4d2f6be6c603523
- SHA1
  
  5788502989ef5cc8800f25b535102d81e83952b6
- SHA256
  
  8c9a9e2dbd989b305b55eb0eb7ab418dfa647d9c2c1bd87cdee4fa4e8a14ff83
- SHA512
  
  0f3d254faf443a773dc74e8bbf2eb46bbdf3e6d3d1437402e7b1713bbb1cf6e0f92d7c7aada8b1270d4f9a65f7aadbe1b59bde7b015330947c4d90a89389133c
Score

9^/10

evasion execution pyinstaller ransomware
- Renames multiple (213) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

evasionexecutionpyinstallerransomware