Overview

overview

9

Static

static

7

6413cddd8d...0N.exe

windows7-x64

9

6413cddd8d...0N.exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    6413cddd8d336da1b3186c02abceb970N

  • Size

    90KB

  • Sample

    240911-v25wgsshrp

  • MD5

    6413cddd8d336da1b3186c02abceb970

  • SHA1

    e67e69de36e89195c2578983ca8fd0804320cc03

  • SHA256

    375f6b38ce129e7598bcb22a2dd140d44a081ad24d6ce77e40eca9c3b9031d21

  • SHA512

    f5b47500ff45a50f13653466da32080134babd72cd78eb894d3175587ba0b871bf6b9d7afb337d2598301d86c34604523fa518318ad818ff7d59159fe08bdf36

  • SSDEEP

    1536:CTW7JJZENTNyoKIKzTW7JJZENTNyoKIK8:htE5KIKctE5KIK8

Score
9/10
discoveryransomwareupx

Malware Config

Targets

    • Target

      6413cddd8d336da1b3186c02abceb970N

    • Size

      90KB

    • MD5

      6413cddd8d336da1b3186c02abceb970

    • SHA1

      e67e69de36e89195c2578983ca8fd0804320cc03

    • SHA256

      375f6b38ce129e7598bcb22a2dd140d44a081ad24d6ce77e40eca9c3b9031d21

    • SHA512

      f5b47500ff45a50f13653466da32080134babd72cd78eb894d3175587ba0b871bf6b9d7afb337d2598301d86c34604523fa518318ad818ff7d59159fe08bdf36

    • SSDEEP

      1536:CTW7JJZENTNyoKIKzTW7JJZENTNyoKIK8:htE5KIKctE5KIK8

    Score
    9/10
    discoveryransomwareupx

    • Renames multiple (344) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks