Overview

overview

9

Static

static

3

whatchanged.exe

windows11-21h2-x64

Resubmissions

07/08/2025, 18:39

250807-xapfjavvhz8

07/08/2025, 18:35

250807-w8r4msdm3t3

07/08/2025, 18:06

250807-wp5wdsdk619

07/08/2025, 17:46

250807-wcnfksvshs8

07/08/2025, 17:14

250807-vr5gzacp2x8

07/08/2025, 16:44

250807-t84rbsyjy68

07/08/2025, 12:44

250807-pyqdqs1thy3

07/08/2025, 12:42

250807-pxsgpsvns83

07/08/2025, 11:49

250807-nzd7eszybt3

07/08/2025, 11:25

250807-njne6agm9w8

Sharing

Copy URL Twitter E-mail

General

  • Target
    whatchanged.exe
  • Size 96KB
  • Sample250807-wp5wdsdk61
  • SHA256 29a11c3256cfa47cd82695554d63cd373951e17f7e6bb77d7c2ec236c71a4c75
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
defense_evasiondiscoveryevasionmotwpersistencephishingransomware

Malware Config

Targets

    • Target
      whatchanged.exe
    • Size 96KB
    • SHA256 29a11c3256cfa47cd82695554d63cd373951e17f7e6bb77d7c2ec236c71a4c75
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryevasionmotwpersistencephishingransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Contacts a large (519) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Downloads MZ/PE file

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks