e04c6cc9cc69d2245892b179fa18ea758683870c2359123a727fe71bdf15a5dd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d04a5b9d649ec15bd5b913851efceee0N
Size

637KB
Sample

240908-a4xyfavcjl
MD5

d04a5b9d649ec15bd5b913851efceee0
SHA1

1dbb85bee09bc4e66d35684682ad8cc99550362c
SHA256

e04c6cc9cc69d2245892b179fa18ea758683870c2359123a727fe71bdf15a5dd
SHA512

12e3c40a35bca84a7f86621840859bb1e11e06d84853a44f037ce967ba134c1c84dc2e19dc30eea970e8446241a911d84ca21613eaa3aac4fc8a520ed1d8b392
SSDEEP

6144:CX/MuvCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:S7a3iwbihym2g7XO3LWUQfh4Co

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Targets

- Target
  
  d04a5b9d649ec15bd5b913851efceee0N
- Size
  
  637KB
- MD5
  
  d04a5b9d649ec15bd5b913851efceee0
- SHA1
  
  1dbb85bee09bc4e66d35684682ad8cc99550362c
- SHA256
  
  e04c6cc9cc69d2245892b179fa18ea758683870c2359123a727fe71bdf15a5dd
- SHA512
  
  12e3c40a35bca84a7f86621840859bb1e11e06d84853a44f037ce967ba134c1c84dc2e19dc30eea970e8446241a911d84ca21613eaa3aac4fc8a520ed1d8b392
- SSDEEP
  
  6144:CX/MuvCE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHk:S7a3iwbihym2g7XO3LWUQfh4Co
Score

9^/10

discovery persistence ransomware spyware stealer
- Renames multiple (176) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceransomwarespywarestealer

behavioral2

discoverypersistenceransomwarespywarestealer