Overview

overview

10

Static

static

10

5f71dd1c8d...a6.exe

windows7-x64

9

5f71dd1c8d...a6.exe

windows10-2004-x64

10

Resubmissions

02-10-2024 02:10

241002-clzqessapl 10

02-10-2024 01:17

241002-bnjljszdlq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    241001-kx44aayg98_pw_infected.zip

  • Size

    317KB

  • Sample

    241002-clzqessapl

  • MD5

    15c720874a3a11b744d68f79d37221ee

  • SHA1

    fcc16f6be16ef1b4045813b31d7331aa3c12d6da

  • SHA256

    50b9d2d51d7b6a9d840553ed57d62b5275fc634678fbf5c18ca325c40e498d89

  • SHA512

    e97fe510b77dde0d267c79d3a2d429aef5680fd37a3c9e48ecd775501e33d029b1ad8b2a3ecba2efc6b2a4a7e9705d9a000ca78f03b58dcbfea785f1d8b63adf

  • SSDEEP

    6144:jBV8P614jG4WX4mquRcAk1HMku2jlzymBQG7QCpAjyHI8iZ77efl6u:jMPzlCqFuilOmVQ/j4I7pzu

Score
10/10
xoristdiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6

    • Size

      1.0MB

    • MD5

      ab3efab870ac3028150e09bad29d3915

    • SHA1

      b2da017a75500314b9f58aa08efbc50144bbc28f

    • SHA256

      5f71dd1c8d2794eac06a4720d560d1185ace4344862aabfbb812316df473cba6

    • SHA512

      49c2002a2d3377a74f2524c534110eaff870078ed983e53b5d3ecd987636f0af80de5033994435da93ca257347826101dc45c4910b0d74a0e5315841458a51c0

    • SSDEEP

      12288:ifleEcqyvTszMbQw+WL/k6ewli/Knnat93Rq:wl5cHbu4L/jlJnaXRq

    Score
    10/10
    persistenceransomwarespywarestealerdiscovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Renames multiple (1911) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks