Overview

overview

9

Static

static

7

205b2a2da3...0N.exe

windows7-x64

9

205b2a2da3...0N.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    205b2a2da30bcd59ed423332c7ce9950N.exe

  • Size

    115KB

  • Sample

    240829-a848bavgpc

  • MD5

    205b2a2da30bcd59ed423332c7ce9950

  • SHA1

    3c4d630db8de76d63ddbff633f51e7191efb2371

  • SHA256

    abf9e78f9f50b3055eee3810cda0ba7ed95ffc9e2174eb74629920ce5ff4c08c

  • SHA512

    8a05253a4af6a90187e0ea7aba099ddb7089f3746bc18041921f548a7d67194e3443e24f8117e9d3b12dd2bebe4cc3f1a21c2259641c6e7d5c951552a426369e

  • SSDEEP

    1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxtTWn1++PJHJXA/OsIZfzc3/Q8zxSWN:KQSokQSoVWN

Score
9/10
discoveryransomwareupx

Malware Config

Targets

    • Target

      205b2a2da30bcd59ed423332c7ce9950N.exe

    • Size

      115KB

    • MD5

      205b2a2da30bcd59ed423332c7ce9950

    • SHA1

      3c4d630db8de76d63ddbff633f51e7191efb2371

    • SHA256

      abf9e78f9f50b3055eee3810cda0ba7ed95ffc9e2174eb74629920ce5ff4c08c

    • SHA512

      8a05253a4af6a90187e0ea7aba099ddb7089f3746bc18041921f548a7d67194e3443e24f8117e9d3b12dd2bebe4cc3f1a21c2259641c6e7d5c951552a426369e

    • SSDEEP

      1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxtTWn1++PJHJXA/OsIZfzc3/Q8zxSWN:KQSokQSoVWN

    Score
    9/10
    discoveryransomwareupx

    • Renames multiple (4640) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks