Overview

overview

9

Static

static

trabajo escuela.exe

windows7_x64

9

trabajo escuela.exe

windows10_x64

9

Resubmissions

09-04-2024 21:00

240409-ztcbesed8x 10

13-10-2021 12:07

211013-paebkaeah7 9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    trabajo escuela.exe

  • Size

    614KB

  • Sample

    211013-paebkaeah7

  • MD5

    535994874b99eea69b30569bc7176440

  • SHA1

    e10245fd72b3ff5f219b18fb292fb3b33ae3a3e5

  • SHA256

    79c0f9223e6861b8bf5f6f3ef860bc517e8fcb544efee34bb5f2cc9867af75a7

  • SHA512

    12bb6e3737f545ecbef371e079d6764d8e35ff8f940258b430f16e07d34e214c030f6ce0518461639178209fe2da62941a1de763fc25490c0e02e8e064da596f

Score
9/10
evasionransomwarespywarestealer

Malware Config

Targets

    • Target

      trabajo escuela.exe

    • Size

      614KB

    • MD5

      535994874b99eea69b30569bc7176440

    • SHA1

      e10245fd72b3ff5f219b18fb292fb3b33ae3a3e5

    • SHA256

      79c0f9223e6861b8bf5f6f3ef860bc517e8fcb544efee34bb5f2cc9867af75a7

    • SHA512

      12bb6e3737f545ecbef371e079d6764d8e35ff8f940258b430f16e07d34e214c030f6ce0518461639178209fe2da62941a1de763fc25490c0e02e8e064da596f

    Score
    9/10
    evasionransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks