63a59304d97b6a4e27a4c6ff9291401206169340b1b31fe3ab2cce7c88c8251a | Triage

Sharing

General

Target

scarey.exe
Size

14.0MB
Sample

250328-xjempa1qz9
MD5

23924d1f690c6fbf73d7b7319ed4f006
SHA1

9d75d40bdd001f38156a129fe910fd400ae0075d
SHA256

63a59304d97b6a4e27a4c6ff9291401206169340b1b31fe3ab2cce7c88c8251a
SHA512

de9c1d9729b77017eec4c7f2eaa394ce2bdb4ba1e5dbfa9a7eb9d7ae843c07bb994162ef676d999465ec096eb8441e5400f4b93ac007a445f1f851fb98cfbea6
SSDEEP

393216:AmW84Gwq3Obs2CltXMCHWUjLVg74w/ADF5ILf5kG9Py:jW84Gwq3ObRqtXMb8hDw/KLILf5kGdy

Score

9^/10

defense_evasion execution impact pyinstaller ransomware

Malware Config

Targets

- Target
  
  scarey.exe
- Size
  
  14.0MB
- MD5
  
  23924d1f690c6fbf73d7b7319ed4f006
- SHA1
  
  9d75d40bdd001f38156a129fe910fd400ae0075d
- SHA256
  
  63a59304d97b6a4e27a4c6ff9291401206169340b1b31fe3ab2cce7c88c8251a
- SHA512
  
  de9c1d9729b77017eec4c7f2eaa394ce2bdb4ba1e5dbfa9a7eb9d7ae843c07bb994162ef676d999465ec096eb8441e5400f4b93ac007a445f1f851fb98cfbea6
- SSDEEP
  
  393216:AmW84Gwq3Obs2CltXMCHWUjLVg74w/ADF5ILf5kG9Py:jW84Gwq3ObRqtXMb8hDw/KLILf5kGdy
Score

9^/10

defense_evasion execution impact ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Loads dropped DLL
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

defense_evasionexecutionimpactransomware