Overview

overview

10

Static

static

10

458455e843...98.exe

windows7-x64

9

458455e843...98.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898

  • Size

    160KB

  • Sample

    250102-v6694szlas

  • MD5

    f33a0c04a1984e22cf953cc811f6d4cf

  • SHA1

    90eb7457e9952738195f7203bdde11ee8a77c8ba

  • SHA256

    458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898

  • SHA512

    e241c70576f99f84575a05c5d1e9a112e91d3ebb1578d364dac1a0f5d25a8c7fff82ca8aa5e1a5598e7e0800c149f4c648630b41a6ae790e37713040d802d5fb

  • SSDEEP

    3072:vDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368+QBVBuEsMeUI/EQ9BW:R5d/zugZqll3LHVeVB

Score
10/10
lockbitdefense_evasiondiscoveryransomware

Malware Config

Targets

    • Target

      458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898

    • Size

      160KB

    • MD5

      f33a0c04a1984e22cf953cc811f6d4cf

    • SHA1

      90eb7457e9952738195f7203bdde11ee8a77c8ba

    • SHA256

      458455e84390b7cdcc4008e104717ef1255245707e3329978a22e0129374d898

    • SHA512

      e241c70576f99f84575a05c5d1e9a112e91d3ebb1578d364dac1a0f5d25a8c7fff82ca8aa5e1a5598e7e0800c149f4c648630b41a6ae790e37713040d802d5fb

    • SSDEEP

      3072:vDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368+QBVBuEsMeUI/EQ9BW:R5d/zugZqll3LHVeVB

    Score
    9/10
    defense_evasiondiscoveryransomware

    • Renames multiple (200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks