Overview

overview

10

Static

static

10

4e811d4be3...d4.exe

windows7-x64

9

4e811d4be3...d4.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4

  • Size

    240KB

  • Sample

    240524-1fjn1sbh4v

  • MD5

    68b61e23d7a30cf67030cb25c52784cb

  • SHA1

    38778ef76f1010f40ce70f40504140bb2652a064

  • SHA256

    4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4

  • SHA512

    6597a072e56dbb972017e80ae0d1cbd4d764c3022c89a3bdc5ce0bda9a22d97e04b3d37ccc01fd1ce499bf301962d972d411253e872d7c2c7287e3a0fab8c3c8

  • SSDEEP

    3072:hfAIuZAIuYSMjoqtMHfhfSE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrOf:hfAIuZAIuDMVtM/D95pK7ShcHUae

Score
10/10
ransomwareupx

Malware Config

Targets

    • Target

      4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4

    • Size

      240KB

    • MD5

      68b61e23d7a30cf67030cb25c52784cb

    • SHA1

      38778ef76f1010f40ce70f40504140bb2652a064

    • SHA256

      4e811d4be34b5de7e2561be12d77857d12755aac007d9effd19e5a574efe8dd4

    • SHA512

      6597a072e56dbb972017e80ae0d1cbd4d764c3022c89a3bdc5ce0bda9a22d97e04b3d37ccc01fd1ce499bf301962d972d411253e872d7c2c7287e3a0fab8c3c8

    • SSDEEP

      3072:hfAIuZAIuYSMjoqtMHfhfSE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrOf:hfAIuZAIuDMVtM/D95pK7ShcHUae

    Score
    9/10
    ransomwareupx

    • Renames multiple (3498) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks