dc55df0e890f872e4997e73a79ad263bd4225350d1501586e17e68e7f0ca0674 | Triage

Resubmissions

12/05/2024, 17:56

240512-wh8cyacb32 10

28/04/2024, 02:06

240428-cjmcbadh29 10

Sharing

Copy URL Twitter E-mail

General

Target

dc55df0e890f872e4997e73a79ad263bd4225350d1501586e17e68e7f0ca0674.exe
Size

2.8MB
Sample

240512-wh8cyacb32
MD5

60f960ca14f0f19e093932368a10809c
SHA1

ef9d4a8468d7643241faba82f59af13846270b5d
SHA256

dc55df0e890f872e4997e73a79ad263bd4225350d1501586e17e68e7f0ca0674
SHA512

8da5832dd06ce07a3fe279f1a1b69fc03d8b79a71adeb719e81740c934260af1ae95026e51857a46b36134900693fd802c8f2519824eee91baf64d06bc732b37
SSDEEP

49152:hg7PO6x4NooFnEjYsZvcfUNkHUKaGiHIkRNqGS:hv6xiownEj9vcfm

Score

10^/10

defense_evasion evasion execution impact ransomware spyware stealer trojan

Malware Config

Targets

- Target
  
  dc55df0e890f872e4997e73a79ad263bd4225350d1501586e17e68e7f0ca0674.exe
- Size
  
  2.8MB
- MD5
  
  60f960ca14f0f19e093932368a10809c
- SHA1
  
  ef9d4a8468d7643241faba82f59af13846270b5d
- SHA256
  
  dc55df0e890f872e4997e73a79ad263bd4225350d1501586e17e68e7f0ca0674
- SHA512
  
  8da5832dd06ce07a3fe279f1a1b69fc03d8b79a71adeb719e81740c934260af1ae95026e51857a46b36134900693fd802c8f2519824eee91baf64d06bc732b37
- SSDEEP
  
  49152:hg7PO6x4NooFnEjYsZvcfUNkHUKaGiHIkRNqGS:hv6xiownEj9vcfm
Score

10^/10

defense_evasion evasion execution impact ransomware spyware stealer trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Stops running service(s)
  evasion execution
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Windows Management Instrumentation

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Service Stop

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactransomwarespywarestealertrojan