Extracted

• • Target

    PIC180168.jpg.js

  • Size

    253KB

  • MD5

    2c0a6e6f385e471bdb870a723e33cc4d

  • SHA1

    07415191a13e6943eb2e0f41bdf6cf7acfa70156

  • SHA256

    6389e3c49b6f4009ca0f1631436d481065a3b3cfab7a15a073edbb61dd971c73

  • SHA512

    39ca7bbd702a4aede2f57406d57cf1e7a05128e2723372fe084e7db9bf69594fe904cfd5d6f6a92d4b95fda9edd575d10977a9f8b52ae526fbf19fc204746048

  Score

  10^/10

  persistenceevasiontrojanransomware

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run entry to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service

    persistence
  behavioral1behavioral2