83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2 | Triage

Sharing

General

Target

83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
Size

53KB
Sample

241023-qsj57ssenh
MD5

ae0de63d46ce36491a606bd70341a63b
SHA1

1e9d6893ec493e7a0ac565011d3aa31b0de29303
SHA256

83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
SHA512

cba5b2e08963afb6cdca724cfb6561ac43015c67ef4b3d2de3dbbda9060b7bd70a3bc461cf2e4a3b47ab27b35c30952ac9c7aa8ca0393dbcf9170da065132852
SSDEEP

768:kulvujToXfzMb/V5D2GhR1qNULB7zOzSgYV5lH8oT9To:ku6hR5LcYZ98

Score

9^/10

defense_evasion evasion execution impact ransomware spyware stealer

Malware Config

Targets

- Target
  
  83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
- Size
  
  53KB
- MD5
  
  ae0de63d46ce36491a606bd70341a63b
- SHA1
  
  1e9d6893ec493e7a0ac565011d3aa31b0de29303
- SHA256
  
  83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
- SHA512
  
  cba5b2e08963afb6cdca724cfb6561ac43015c67ef4b3d2de3dbbda9060b7bd70a3bc461cf2e4a3b47ab27b35c30952ac9c7aa8ca0393dbcf9170da065132852
- SSDEEP
  
  768:kulvujToXfzMb/V5D2GhR1qNULB7zOzSgYV5lH8oT9To:ku6hR5LcYZ98
Score

9^/10

defense_evasion evasion execution impact ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (236) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

defense_evasionevasionexecutionimpactransomwarespywarestealer