General
-
Target
801c430414f434df6fc24a9891b3b118.bin
-
Size
2.1MB
-
Sample
241114-bt6y2asfnp
-
MD5
2e60303a83724691e75b22168c72a33f
-
SHA1
f5e1665ce85877cdde84d7ce5e8ca58ab353c5c2
-
SHA256
b1b23141e605644529badb41c5e32a02948079dcdcda1924180c774b009ee42f
-
SHA512
2ea80a3698d82e9defdaff70f814fb9f22fc7342da60b4c323bc02716dbefd3202eea0757033fcc9c320c4c563a627cda1916c3c2de61af0a69e130eeacaa7f2
-
SSDEEP
49152:+gFb7iyzxIiBL1RnaOAbTcijPceVC3AXXBEiyJ4met6d8rHU5oP9p:fniyGi1cbn4eVCQHidJMtvDU2D
Static task
static1
Behavioral task
behavioral1
Sample
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\README.txt
Extracted
C:\Users\Admin\AppData\Local\README.txt
Targets
-
-
Target
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe
-
Size
2.2MB
-
MD5
801c430414f434df6fc24a9891b3b118
-
SHA1
27301b1a6c2078f4eec06ec6f1f947f22a1598fc
-
SHA256
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68
-
SHA512
e2c5e42a09c235d89ceb298ed27815c5b922e547568111ae916032f5cb85d89b197080d6641cf697f2fa18e11aebe66bef1669dc2155e9a89bfeb5e05eff1c29
-
SSDEEP
49152:wgwRwifu1DBgutBPNcpwcjVpNMkCZZpsYpmwZ3hQ8cTEo8:wgwRwvguPP4wc3NMkCGGmugTEt
-
Detects Mimic ransomware
-
Mimic family
-
Modifies boot configuration data using bcdedit
-
Renames multiple (9310) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1