Extracted

Extracted

• • Target

    2.exe

  • Size

    2.5MB

  • MD5

    e63e41e15e86489a98dbeb2e6cb44e8a

  • SHA1

    5815d349a375f5cdf090ababcff86b3946ed6c07

  • SHA256

    0dd34e1326f18ab113be5ec91003577845f62ce25bbed8f92bff0b4077fe45da

  • SHA512

    749d9580ac631916fbc1db207f0f48ed2ff9979f0cd8e352633cd86edfe7bd5bbb6da90b014e0b8ad639f8b9e567498f07353ef907ce2bd6dfa5536d3079991e

  Score

  10^/10

  evasionpersistenceransomwarespywaretrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Deletes System State backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Drops file in Drivers directory

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Enumerates physical storage devices

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2