Overview

overview

10

Static

static

10

81feec4a20...8f.exe

windows7-x64

9

81feec4a20...8f.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f

  • Size

    682KB

  • Sample

    240522-3rpqhsdf94

  • MD5

    f849e424deb6622c9872620e6bb2a5cf

  • SHA1

    c1ffd0087ef183737e006984b9a137de724c95c3

  • SHA256

    81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f

  • SHA512

    81d66e9bf27ac10c0d44cee608be3af753e31118a7852a93ded3433ef7d2eb36aa325cc1021b9f99727493997cb33d788a6e08d49c5926b871ffebd5c0f3de1c

  • SSDEEP

    12288:7AIuZAIuOYS3ycUVRMstsD5pAfujVvaYMLc9RS/o:IYS3ycU/zt45W6vdLR

Score
10/10
ransomwareupx

Malware Config

Targets

    • Target

      81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f

    • Size

      682KB

    • MD5

      f849e424deb6622c9872620e6bb2a5cf

    • SHA1

      c1ffd0087ef183737e006984b9a137de724c95c3

    • SHA256

      81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f

    • SHA512

      81d66e9bf27ac10c0d44cee608be3af753e31118a7852a93ded3433ef7d2eb36aa325cc1021b9f99727493997cb33d788a6e08d49c5926b871ffebd5c0f3de1c

    • SSDEEP

      12288:7AIuZAIuOYS3ycUVRMstsD5pAfujVvaYMLc9RS/o:IYS3ycU/zt45W6vdLR

    Score
    9/10
    ransomwareupx

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

    • Renames multiple (3447) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks