Analysis
-
max time kernel
290s -
max time network
256s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 03:36
General
-
Target
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
-
Size
621KB
-
MD5
a7f91301712b5a3cc8c3ab9c119530ce
-
SHA1
22c17c048eacd78038e820350181e2fb1aa2fe75
-
SHA256
f1384ff19a870f5aa718486666a14e88873d79eaea5725e3a2097b2d9fd9a320
-
SHA512
53f608c8ab14595559ea91f028632c427c60b490ab79f57f6ac8b09dfd3920b69acf011ca0d8891fb3a3db474967691d69acb9175d777be65a0ab9b71b7e135f
-
SSDEEP
12288:o8S/eSSa+KprpGAOB+TJyZJKiPKIQInLDIAvcn0YP2TFjqHHsFNW0jGjG:NS/rSarrpGr+1yzKUKIQILDIAknzuBje
Malware Config
Signatures
-
Renames multiple (109) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr"C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr" /S1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr"C:\Users\Admin\AppData\Local\Temp\ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr" /S2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266B
MD59362f31b8a3134cc3f397ffdcd0757f0
SHA10ca54647ddad37ef9a9c0460bcef301633ef8084
SHA256bd294be727573fa981152db69f31ba4b9290431dfa4a0141ae6b7c795e164fcd
SHA512bad69c309958f8fa8230cf12aadf37ff748b0563591e3b76eff03d72f90b59368685c469224f1cc10654125fe5aadcde59d588cb6adf3ee016aee3cf6b88e346
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB