17db6fd9f81222711b1f33983a8f64b8c3bddfc7dc25f4f6b6e0c6c29d877eeb | Triage

Resubmissions

05-10-2024 14:52

241005-r81csszekf 9

20-08-2024 13:23

240820-qm5jystfpc 9

Sharing

General

Target

Morgan.exe
Size

14KB
Sample

240820-qm5jystfpc
MD5

cd2149ef2f2c9675e75a224c10f60a8e
SHA1

a1a962caae493a33f947ff6412d18f864c7fc3fb
SHA256

17db6fd9f81222711b1f33983a8f64b8c3bddfc7dc25f4f6b6e0c6c29d877eeb
SHA512

0aad285dcf287da822d1e9abdb444a4c353c66f054f5828df8fd4a7ebdc41ab0e269d4171e99cfee6f4857c5859a663c8b5f0345a0395e2ee2b0ee1dbbc965aa
SSDEEP

192:hI/3edqmr6APSJg15CHEcWIW2g93EUY68FL8GZDAPIrIvCGmaMiDVQvr:HdPKi15Ck4W2g9UUg8GRXLuMiDVMr

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  Morgan.exe
- Size
  
  14KB
- MD5
  
  cd2149ef2f2c9675e75a224c10f60a8e
- SHA1
  
  a1a962caae493a33f947ff6412d18f864c7fc3fb
- SHA256
  
  17db6fd9f81222711b1f33983a8f64b8c3bddfc7dc25f4f6b6e0c6c29d877eeb
- SHA512
  
  0aad285dcf287da822d1e9abdb444a4c353c66f054f5828df8fd4a7ebdc41ab0e269d4171e99cfee6f4857c5859a663c8b5f0345a0395e2ee2b0ee1dbbc965aa
- SSDEEP
  
  192:hI/3edqmr6APSJg15CHEcWIW2g93EUY68FL8GZDAPIrIvCGmaMiDVQvr:HdPKi15Ck4W2g9UUg8GRXLuMiDVMr
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (295) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer