General
-
Target
39f8fe85b41c745e4082594c64e17d26178f583f7a6f86f546892435552c43cb
-
Size
266KB
-
Sample
240523-y7jf8afa8s
-
MD5
a9096d488f4a78e2f295705012f513b6
-
SHA1
2ae533414c1a6a5e4a92c0b86f2b8359c90d0e84
-
SHA256
39f8fe85b41c745e4082594c64e17d26178f583f7a6f86f546892435552c43cb
-
SHA512
08cc71d4209f69e3a3b60cf7da2136f48fad041a3c59c6007a4e7e566c13e4b9e99c8183ceb915b4b0812177e2b45e7b8a4239a5d294016e4fa08e6abee0dea3
-
SSDEEP
6144:PutR5Pdf+Ish3vlEnuUD/CZtUCOH+rY3i7s1:PKRZZ+Isv0PkOHri6
Static task
static1
Behavioral task
behavioral1
Sample
39f8fe85b41c745e4082594c64e17d26178f583f7a6f86f546892435552c43cb.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
39f8fe85b41c745e4082594c64e17d26178f583f7a6f86f546892435552c43cb.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
39f8fe85b41c745e4082594c64e17d26178f583f7a6f86f546892435552c43cb
-
Size
266KB
-
MD5
a9096d488f4a78e2f295705012f513b6
-
SHA1
2ae533414c1a6a5e4a92c0b86f2b8359c90d0e84
-
SHA256
39f8fe85b41c745e4082594c64e17d26178f583f7a6f86f546892435552c43cb
-
SHA512
08cc71d4209f69e3a3b60cf7da2136f48fad041a3c59c6007a4e7e566c13e4b9e99c8183ceb915b4b0812177e2b45e7b8a4239a5d294016e4fa08e6abee0dea3
-
SSDEEP
6144:PutR5Pdf+Ish3vlEnuUD/CZtUCOH+rY3i7s1:PKRZZ+Isv0PkOHri6
Score10/10-
Modifies visibility of file extensions in Explorer
-
Renames multiple (58) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1