Overview

overview

10

Static

static

10

56bbc0e8d4...fe.exe

windows7-x64

9

56bbc0e8d4...fe.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    56bbc0e8d4487c61844ed950ece3573e8c47bac2741cee508942f2f7d994fbfe

  • Size

    95KB

  • Sample

    240514-1ra61saf56

  • MD5

    c78d76cb60009e09a17a7a718cb684ed

  • SHA1

    f38f87be55cfac64f1ef920b145c2811026c3e55

  • SHA256

    56bbc0e8d4487c61844ed950ece3573e8c47bac2741cee508942f2f7d994fbfe

  • SHA512

    95c61462132431ebfb5009c55ecebf2cc6a3eeb693ebff9bcb3f3fb055271865ba048a4704b16a23ebc1ad5ae051cd944386bb682b2d373238ebd2a34136474d

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJyTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJB:KQSoMQSoH

Score
10/10
ransomwareupx

Malware Config

Targets

    • Target

      56bbc0e8d4487c61844ed950ece3573e8c47bac2741cee508942f2f7d994fbfe

    • Size

      95KB

    • MD5

      c78d76cb60009e09a17a7a718cb684ed

    • SHA1

      f38f87be55cfac64f1ef920b145c2811026c3e55

    • SHA256

      56bbc0e8d4487c61844ed950ece3573e8c47bac2741cee508942f2f7d994fbfe

    • SHA512

      95c61462132431ebfb5009c55ecebf2cc6a3eeb693ebff9bcb3f3fb055271865ba048a4704b16a23ebc1ad5ae051cd944386bb682b2d373238ebd2a34136474d

    • SSDEEP

      1536:CTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJyTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJB:KQSoMQSoH

    Score
    9/10
    ransomwareupx

    • Renames multiple (480) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks