Overview

overview

10

Static

static

10

2024-09-02...de.exe

windows11-21h2-x64

9

Resubmissions

02-09-2024 06:45

240902-hh76aavbjj 10

02-09-2024 06:24

240902-g6hpvsvfla 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-02_20b0043ff680ffd554923069b7150b6a_darkside

  • Size

    147KB

  • Sample

    240902-hh76aavbjj

  • MD5

    20b0043ff680ffd554923069b7150b6a

  • SHA1

    5f5caf42e317e617994069453fb1c8d86fd2f1ee

  • SHA256

    879e3a5051e3d56eaac8056e91dd8dcd11433198c0fc40866bf074c16f333ded

  • SHA512

    a0757ad09a010d4ba7f3b5558e0e232c1faf3ca4e7b83d343150beee2b5341b767cbaaf4a17d9f3bb0e8f76b9a20f9fddf05c37ff3cdbfb28168dcdff160da44

  • SSDEEP

    3072:x6glyuxE4GsUPnliByocWepFsvLGJJC0iohCI:x6gDBGpvEByocWe3svLMJhr

Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Targets

    • Target

      2024-09-02_20b0043ff680ffd554923069b7150b6a_darkside

    • Size

      147KB

    • MD5

      20b0043ff680ffd554923069b7150b6a

    • SHA1

      5f5caf42e317e617994069453fb1c8d86fd2f1ee

    • SHA256

      879e3a5051e3d56eaac8056e91dd8dcd11433198c0fc40866bf074c16f333ded

    • SHA512

      a0757ad09a010d4ba7f3b5558e0e232c1faf3ca4e7b83d343150beee2b5341b767cbaaf4a17d9f3bb0e8f76b9a20f9fddf05c37ff3cdbfb28168dcdff160da44

    • SSDEEP

      3072:x6glyuxE4GsUPnliByocWepFsvLGJJC0iohCI:x6gDBGpvEByocWe3svLMJhr

    Score
    9/10
    defense_evasiondiscoveryransomwarespywarestealer

    • Renames multiple (590) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks