Extracted

• • Target

    PIC114110.jpg.js

  • Size

    83KB

  • MD5

    821a6c3122354612133a542992bab324

  • SHA1

    efdbbf3dbeed7f53ccf2b73d7afcc6d16c8ca320

  • SHA256

    370dbeca970b02f6c1a07803c736de0fa30a40851f7a21178eb0bdaa16af61ab

  • SHA512

    6474f350bf4790a681677400019d2540d75468d307535a73f296acb3792fb8b19e14140c6b0ad712cd91d493fdeea59048117d07853f2d6c6f189a906a17dc46

  Score

  10^/10

  persistenceevasiontrojanransomware

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run entry to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service

    persistence
  behavioral1behavioral2