a21839b1f4ec7d9fa765bedf282699bdd84ed354eebfc6317bd09674b01894fb

Target

Cracka.rar
Size

18.1MB
Sample

241206-e5x22szqet
MD5

681be9b88898fa0cdb6f9a8f41b248ec
SHA1

ce3153537fc5bbe19524d475922b1423fdacd109
SHA256

a21839b1f4ec7d9fa765bedf282699bdd84ed354eebfc6317bd09674b01894fb
SHA512

7c8f4fa515cd839b25694fb5f0593b2fbd905100626718b7a4e32958a9a85f6c48ebf7235108d65c57e379bfd5760b1ca976cf0048e079a366118166ec79574b
SSDEEP

393216:V6/rhud0xQt8EJzrF3+Evma7sJ170jVMTZE3fzYXwKpuGqQM0j:V6NudcQxxOEvq8VMcYgKpVL

Score

9^/10

Malware Config

Targets

- Target
  
  Cracka.rar
- Size
  
  18.1MB
- MD5
  
  681be9b88898fa0cdb6f9a8f41b248ec
- SHA1
  
  ce3153537fc5bbe19524d475922b1423fdacd109
- SHA256
  
  a21839b1f4ec7d9fa765bedf282699bdd84ed354eebfc6317bd09674b01894fb
- SHA512
  
  7c8f4fa515cd839b25694fb5f0593b2fbd905100626718b7a4e32958a9a85f6c48ebf7235108d65c57e379bfd5760b1ca976cf0048e079a366118166ec79574b
- SSDEEP
  
  393216:V6/rhud0xQt8EJzrF3+Evma7sJ170jVMTZE3fzYXwKpuGqQM0j:V6NudcQxxOEvq8VMcYgKpVL
Score

9^/10

microsoft defense_evasion discovery evasion persistence phishing privilege_escalation ransomware
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  evasion
- Renames multiple (89) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Drops file in Drivers directory
- Modifies Windows Firewall
  evasion
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Detected potential entity reuse from brand MICROSOFT.
  phishing microsoft
behavioral1