General
-
Target
LoaderFuscate.exe
-
Size
13.9MB
-
Sample
250126-nzgbsa1rgn
-
MD5
c07637410f1d07d4fd69030fac313a7f
-
SHA1
72a944ca04c28d7d651468b082ba1630900272e0
-
SHA256
7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b
-
SHA512
747ebeceacf1342bee878ca9aa141b3939c309eee4c14dad3c9ab3f5a7affef45adff9ffc88c7e73368eb7fb3239a242845d4acbd3a3cf5ae94f403209d6393c
-
SSDEEP
393216:pV2YFanmL01+l+uq+VvyUR9LrvF1+TtIiLCS9DNsIRfamd:XE601+l+uqgvyO9fd1QtIQ9iIdd
Behavioral task
behavioral1
Sample
LoaderFuscate.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
LoaderFuscate.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry
http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect
Extracted
C:\RlWCfyLxZ.README.txt
Targets
-
-
Target
LoaderFuscate.exe
-
Size
13.9MB
-
MD5
c07637410f1d07d4fd69030fac313a7f
-
SHA1
72a944ca04c28d7d651468b082ba1630900272e0
-
SHA256
7880389d89e8e28cbf6ac18bfb40dc8661dec9d9723e97b14bea6f8dff91804b
-
SHA512
747ebeceacf1342bee878ca9aa141b3939c309eee4c14dad3c9ab3f5a7affef45adff9ffc88c7e73368eb7fb3239a242845d4acbd3a3cf5ae94f403209d6393c
-
SSDEEP
393216:pV2YFanmL01+l+uq+VvyUR9LrvF1+TtIiLCS9DNsIRfamd:XE601+l+uqgvyO9fd1QtIQ9iIdd
-
Wannacry family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (624) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Download via BitsAdmin
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Management Instrumentation
1Defense Evasion
BITS Jobs
1Direct Volume Access
1Indicator Removal
4File Deletion
4Modify Registry
2