Overview

overview

9

Static

static

3

ransom.exe

windows10-1703-x64

9

Resubmissions

09/06/2024, 14:57

240609-sbqb1acd769

09/06/2024, 14:54

240609-r9vtpscd639

Sharing

Copy URL Twitter E-mail

General

  • Target
    ransom.exe
  • Size 9.6MB
  • Sample240609-sbqb1acd76
  • SHA256 7a9d65371caadae24c4890655a13de8b452d2a85cac57916e6000576ac5f9f80
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
evasionexecutionpersistencepyinstallerransomwarespyware

Malware Config

Targets

    • Target
      ransom.exe
    • Size 9.6MB
    • SHA256 7a9d65371caadae24c4890655a13de8b452d2a85cac57916e6000576ac5f9f80
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasionexecutionpersistencepyinstallerransomwarespyware

    • Renames multiple (281) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks