Overview

overview

10

Static

static

10

676720712.scr

windows10-1703-x64

9

Resubmissions

15/05/2024, 07:41

240515-jjdhqsff6510

15/05/2024, 06:59

240515-hr6ntaec3710

15/05/2024, 05:57

240515-gnsr4sca7z10

Sharing

Copy URL Twitter E-mail

General

  • Target
    676720712.scr
  • Size 194KB
  • Sample240515-jjdhqsff65
  • SHA256 41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
lockbitransomwarespywarestealer

Malware Config

Targets

    • Target
      676720712.scr
    • Size 194KB
    • SHA256 41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    ransomwarespywarestealer

    • Renames multiple (580) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks