Overview

overview

8

Static

static

3

6fdccfbcf3...bd.exe

windows7-x64

7

6fdccfbcf3...bd.exe

windows10-2004-x64

7

$PLUGINSDI...RL.dll

windows7-x64

3

$PLUGINSDI...RL.dll

windows10-2004-x64

3

$PLUGINSDIR/EULA.rtf

windows7-x64

4

$PLUGINSDIR/EULA.rtf

windows10-2004-x64

1

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows7-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDIR/xml.dll

windows7-x64

3

$PLUGINSDIR/xml.dll

windows10-2004-x64

3

$TEMP/scen...er.exe

windows7-x64

8

$TEMP/scen...er.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    6fdccfbcf36463c0d9212d148dd946d0669e334099fe35b0db00317ab837b7bd

  • Size

    1.2MB

  • Sample

    240825-23k12asckm

  • MD5

    3d5459fa1309f3036c5896231bb4d2e3

  • SHA1

    bfe447e5b4035cd16a75c4991f033a3859c2dea8

  • SHA256

    6fdccfbcf36463c0d9212d148dd946d0669e334099fe35b0db00317ab837b7bd

  • SHA512

    da6ffaeb794ca7855a577107a24ea4c37c448f3a6db6c3cd7edb1203c6859074d13d21c51c1419809af7014e0b9fc374ef8a6c7d5de1c28b7544ba0703b786f2

  • SSDEEP

    24576:C2oKPLgtVwGbHW86dyBqXIjNYeTMYgJRPr7fdCNt1HEKDkV:DoKDgDPHDPJYeAtJprYCbV

Score
8/10
discoverypersistenceransomware

Malware Config

Targets

    • Target

      6fdccfbcf36463c0d9212d148dd946d0669e334099fe35b0db00317ab837b7bd

    • Size

      1.2MB

    • MD5

      3d5459fa1309f3036c5896231bb4d2e3

    • SHA1

      bfe447e5b4035cd16a75c4991f033a3859c2dea8

    • SHA256

      6fdccfbcf36463c0d9212d148dd946d0669e334099fe35b0db00317ab837b7bd

    • SHA512

      da6ffaeb794ca7855a577107a24ea4c37c448f3a6db6c3cd7edb1203c6859074d13d21c51c1419809af7014e0b9fc374ef8a6c7d5de1c28b7544ba0703b786f2

    • SSDEEP

      24576:C2oKPLgtVwGbHW86dyBqXIjNYeTMYgJRPr7fdCNt1HEKDkV:DoKDgDPHDPJYeAtJprYCbV

    Score
    7/10
    discovery

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/BrandingURL.dll

    • Size

      4KB

    • MD5

      71c46b663baa92ad941388d082af97e7

    • SHA1

      5a9fcce065366a526d75cc5ded9aade7cadd6421

    • SHA256

      bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    • SHA512

      5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/EULA.rtf

    • Size

      17KB

    • MD5

      0369fd4801819cf7ecec362224c518a7

    • SHA1

      98520ff7afce25000f4c293f7b4b925a368b101d

    • SHA256

      bbfb052969657e005eb1db1e998f2cbd45fd7f44b214fe262a6c5c94443be20f

    • SHA512

      1b4fe3af2ced6614d97358c1f571240c451f91712281dfa01d286a4ad66081aeec0a45ad5b0bf04f83e499977a38ca9d93943b1bd92ceae5a2c02f5f628201a3

    • SSDEEP

      192:zEf8chvUt1wrN2NcerasvDh/ndI0jyGjQLTKQN686NCHyjvtsoeVQTcOHmNoBlRH:zkRUorMfaGFg4WTd6BjvWQlRFyvmsV2

    Score
    4/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/InstallOptions.dll

    • Size

      14KB

    • MD5

      0dc0cc7a6d9db685bf05a7e5f3ea4781

    • SHA1

      5d8b6268eeec9d8d904bc9d988a4b588b392213f

    • SHA256

      8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c

    • SHA512

      814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0

    • SSDEEP

      192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/NSISdl.dll

    • Size

      14KB

    • MD5

      254f13dfd61c5b7d2119eb2550491e1d

    • SHA1

      5083f6804ee3475f3698ab9e68611b0128e22fd6

    • SHA256

      fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28

    • SHA512

      fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7

    • SSDEEP

      192:t5ZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRYgsfA:fBo/680dCI5adOjFOg9//p27uNw2bo

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      00a0194c20ee912257df53bfe258ee4a

    • SHA1

      d7b4e319bc5119024690dc8230b9cc919b1b86b2

    • SHA256

      dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    • SHA512

      3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

    • SSDEEP

      192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/ZipDLL.dll

    • Size

      163KB

    • MD5

      2dc35ddcabcb2b24919b9afae4ec3091

    • SHA1

      9eeed33c3abc656353a7ebd1c66af38cccadd939

    • SHA256

      6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1

    • SHA512

      0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901

    • SSDEEP

      3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/inetc.dll

    • Size

      24KB

    • MD5

      1efbbf5a54eb145a1a422046fd8dfb2c

    • SHA1

      ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

    • SHA256

      983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

    • SHA512

      7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

    • SSDEEP

      384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      ab73c0c2a23f913eabdc4cb24b75cbad

    • SHA1

      6569d2863d54c88dcf57c843fc310f6d9571a41e

    • SHA256

      3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457

    • SHA512

      99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8

    • SSDEEP

      96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/nsExec.dll

    • Size

      6KB

    • MD5

      e54eb27fb5048964e8d1ec7a1f72334b

    • SHA1

      2b76d7aedafd724de96532b00fbc6c7c370e4609

    • SHA256

      ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

    • SHA512

      c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

    • SSDEEP

      96:57GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgN532E:VKgfwgcr8zylsB49Ud0qJVgNQ

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/xml.dll

    • Size

      118KB

    • MD5

      42df1fbaa87567adf2b4050805a1a545

    • SHA1

      b892a6efbb39b7144248e0c0d79e53da474a9373

    • SHA256

      e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

    • SHA512

      4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

    • SSDEEP

      1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK

    Score
    3/10
    discovery
    behavioral21behavioral22

    • Target

      $TEMP/scenic-magicalchristmas-wallpaper.exe

    • Size

      965KB

    • MD5

      aebc5c159cec452d668c4698100ad035

    • SHA1

      556c8223f9409b543cc75d65a6e1c1796ab0da66

    • SHA256

      406eab2062d6b3f9b36014ed9534b93c3c197ad3f6eb9077c61610c85f7312dc

    • SHA512

      b0a6198bcfe13c1c5b3c7bc2134dbd4fafabdfc22871ccd6c784692f606a99759ef4180d17674d1f7cf6c6c6fab36fc61ab87c56b67372066c0d718d552adfcd

    • SSDEEP

      12288:DfGQiNVTgaBhg2Un6XxG5Ld9j7TMRrfTkY025btYEjO0rDDayvP3O06EYCk+mynq:DfEDBaKIFH7TMvbJtXr9fP5kOEdJ/LiA

    Score
    8/10
    discoverypersistenceransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral23behavioral24

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
4/10

behavioral6

Score
1/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discoverypersistenceransomware
Score
8/10

behavioral24

discoverypersistenceransomware
Score
8/10