447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9

Analysis

Target

447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9.exe
Size

108KB
MD5

219d8a8b83031ac0096dd3e42f9afd4f
SHA1

701f4751fbf99ed03ffb178d0126f31b10a70226
SHA256

447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9
SHA512

8566277121f4b875664592cacc137dc8770a09b618e01368bbdc942b6ddca55882077ccb928641ab33fc5bc3abc137cab1f96eb36096f5c90a73e66e797999f5

Score

5^/10

ransomware

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

Modify Registry

Processes:

447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\god.jpg"	447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9.exe

C:\Users\Admin\AppData\Local\Temp\447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9.exe
"C:\Users\Admin\AppData\Local\Temp\447bd8bf62c014f573447c63634520372aa08ba359d0bc87b631e09d0c209fb9.exe"
1⤵
- Sets desktop wallpaper using registry
PID:1828

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

memory/1828-54-0x0000000076271000-0x0000000076273000-memory.dmp

Filesize
8KB

Download