Overview

overview

10

Static

static

10

2024-09-26...de.exe

windows7-x64

9

2024-09-26...de.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-09-26_76a0d2ef15e408b4a07f534c8d056b30_darkside

  • Size

    146KB

  • Sample

    240926-fgnzxaycln

  • MD5

    76a0d2ef15e408b4a07f534c8d056b30

  • SHA1

    7ddc10e637b0ab439b80a193420b00bcf03c3dd7

  • SHA256

    2317d33628eb06af24d1d6d94ff892d6fb6a7ecca24094d477f5c77829ca35c0

  • SHA512

    48f709fe69c2aa219ee40167f1f82806fd003b697b6ecc96aa87826670b12533530a9314a4a642e92784ef59b4a97628ab27a4c781695a37d946ca624f6fff67

  • SSDEEP

    3072:D6glyuxE4GsUPnliByocWepOsNPfGk21h:D6gDBGpvEByocWeqN

Score
10/10
lockbitdefense_evasiondiscoveryransomware

Malware Config

Targets

    • Target

      2024-09-26_76a0d2ef15e408b4a07f534c8d056b30_darkside

    • Size

      146KB

    • MD5

      76a0d2ef15e408b4a07f534c8d056b30

    • SHA1

      7ddc10e637b0ab439b80a193420b00bcf03c3dd7

    • SHA256

      2317d33628eb06af24d1d6d94ff892d6fb6a7ecca24094d477f5c77829ca35c0

    • SHA512

      48f709fe69c2aa219ee40167f1f82806fd003b697b6ecc96aa87826670b12533530a9314a4a642e92784ef59b4a97628ab27a4c781695a37d946ca624f6fff67

    • SSDEEP

      3072:D6glyuxE4GsUPnliByocWepOsNPfGk21h:D6gDBGpvEByocWeqN

    Score
    9/10
    defense_evasiondiscoveryransomware

    • Renames multiple (195) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks