General
-
Target
d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27
-
Size
93KB
-
Sample
240818-dm47zavepr
-
MD5
e235430be8eab293f1875debf5c4763c
-
SHA1
6e1554846d507392daf2928c1b37225408631a48
-
SHA256
d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27
-
SHA512
8f635affdf6554846e9a2365461545f77bd80e38c2f3acff0fdd10e0b1926f0a2de21600e5f0a43e8c9c86d93a598014902583fb9d112a6f006ac8bf963dd98c
-
SSDEEP
1536:SeZJ9CEvPSHpbwB+tZA3R/KRWj2Q7PHpdfCgRxrOuvgFy3e23bUEOdKLrFfsISB:F9CYPSuwYR/KR42aJB7RJjNrUkMB
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
-
Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-