General
-
Target
38c582691f96952e2f2431f442e31679a66365dff400bea24b9f96393fad9123
-
Size
259KB
-
Sample
240523-y58ckafb32
-
MD5
c6a246972123927c5e13418c64178852
-
SHA1
10ded04be5a6b66142e74335ed94f54bca29fe6b
-
SHA256
38c582691f96952e2f2431f442e31679a66365dff400bea24b9f96393fad9123
-
SHA512
a1d61a408d46cffca3e805298f79d07566ee777d95cc1f73104318eab04cfd48e5bba90242b603aabbd72dda43043f4e2f0b200c77582c601a3b2ad0745bed0c
-
SSDEEP
6144:7nQpQapXWsIwHZ+1lhh6d/JQJc/Zx9TqPI1kjJXvASZjXFlGt87kzhLT/T+idN:7QpTpXWbwoEMcIvAuGt87mZ/1N
Static task
static1
Behavioral task
behavioral1
Sample
38c582691f96952e2f2431f442e31679a66365dff400bea24b9f96393fad9123.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
38c582691f96952e2f2431f442e31679a66365dff400bea24b9f96393fad9123.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
38c582691f96952e2f2431f442e31679a66365dff400bea24b9f96393fad9123
-
Size
259KB
-
MD5
c6a246972123927c5e13418c64178852
-
SHA1
10ded04be5a6b66142e74335ed94f54bca29fe6b
-
SHA256
38c582691f96952e2f2431f442e31679a66365dff400bea24b9f96393fad9123
-
SHA512
a1d61a408d46cffca3e805298f79d07566ee777d95cc1f73104318eab04cfd48e5bba90242b603aabbd72dda43043f4e2f0b200c77582c601a3b2ad0745bed0c
-
SSDEEP
6144:7nQpQapXWsIwHZ+1lhh6d/JQJc/Zx9TqPI1kjJXvASZjXFlGt87kzhLT/T+idN:7QpTpXWbwoEMcIvAuGt87mZ/1N
Score10/10-
Modifies visibility of file extensions in Explorer
-
Renames multiple (65) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1