Overview

overview

8

Static

static

3

BPFA.exe

windows10-2004-x64

8

BPFA.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BPFA.exe

  • Size

    2.4MB

  • Sample

    250415-yg6ttszpw4

  • MD5

    365bf9812eba8d96ae4638ad64ec012a

  • SHA1

    75dc6415bdc2a3f1414eb0acecd93884f22d6f94

  • SHA256

    4f5aa071b2a076aa3cdff8c39900e4e30d9ae268592e1f0da0b3b45960f59e82

  • SHA512

    6ea7df3aec40915b71c2d841aad4d6d9806cdeca2a776cf78b64b215dfbb880a0ca2fff7635893b127af6a56ab88698faedc57430220c04e94666dbd0d749b60

  • SSDEEP

    49152:KYsjqFhUmKSbmPAmppd4fnz+Crjj6Pxpdna7+1yPw5pOSTgaYsj:ujqF+7vPvd4fniCYxpda7syPCOSMej

Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Targets

    • Target

      BPFA.exe

    • Size

      2.4MB

    • MD5

      365bf9812eba8d96ae4638ad64ec012a

    • SHA1

      75dc6415bdc2a3f1414eb0acecd93884f22d6f94

    • SHA256

      4f5aa071b2a076aa3cdff8c39900e4e30d9ae268592e1f0da0b3b45960f59e82

    • SHA512

      6ea7df3aec40915b71c2d841aad4d6d9806cdeca2a776cf78b64b215dfbb880a0ca2fff7635893b127af6a56ab88698faedc57430220c04e94666dbd0d749b60

    • SSDEEP

      49152:KYsjqFhUmKSbmPAmppd4fnz+Crjj6Pxpdna7+1yPw5pOSTgaYsj:ujqF+7vPvd4fniCYxpda7syPCOSMej

    Score
    8/10
    defense_evasiondiscoverypersistenceransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks