Extracted

Extracted

Extracted

Extracted

• • Target

    test/0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b.doc

  • Size

    265KB

  • MD5

    34c85b83169b5e70bbfc76c2d6de2be0

  • SHA1

    cf7d59f9e2774b8b2de9f578bad3b78947d0c3f8

  • SHA256

    0b627b4eca9b9e8bd04a0d1a103876f6e0fa91049fd0b51bae9ae41acaacf15b

  • SHA512

    0610b68ef9916c73ed782dc60045c914c52dff1dc1258b634dd009303a4837b403334f2e6c35f137e12ca473f30c747cd9e08df2acbc3d2a9a6790b1b469eb4e

  • SSDEEP

    3072:0khgqkhgACSQKaSx+SbtYqS4fvS7GQRbSVuz1QzC9klhxztsZ5QPwYTXjdOSrv:0CwQK3RpVS7G4SVuz1QzLhxztsZGPw0

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  behavioral1behavioral2

• • Target

    test/0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66.doc

  • Size

    81KB

  • MD5

    fac7b441a730abf96b210a8db9dbf3d1

  • SHA1

    9f5bb869b95136f51b954e4284f99168ff0e91fb

  • SHA256

    0dded430c1958ae0ec60c2d50ab99f562269ad1ee09db17606661bd55cd29c66

  • SHA512

    0a5ec69ec554639ede43c359f38f8d2e52718b7e29a06aa112ff8cdc99b2777a39c3a9455d3796033a813cceda7487104fb8f0027eccfa138bcd0c2064606f07

  • SSDEEP

    1536:focn1kp59gxBK85fBlHF5qFycNGrFMMzV/+a9:A41k/W483lWycNGzV

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral3behavioral4

• • Target

    test/91B5DB3C0CCBD68BD04C24571E27F99D.msi

  • Size

    277KB

  • MD5

    91b5db3c0ccbd68bd04c24571e27f99d

  • SHA1

    b01cb4fe38315d41fcbe9c6278ebe4574496ab0d

  • SHA256

    ec85138598c57c6a6bdb5ed470614f582d3b5a8c6b243eb2f41b9970ea13d130

  • SHA512

    9f0b07f961625fcc06ee64fcfe5e35e0d40db81f75c3cbc584434c1925fac241db69cac3c1a1bf329d965a4df9bdaa53c13bb8ea3206e2c9d4facf7f74ba21b7

  • SSDEEP

    3072:GErW9/kks5wgz88ereWn/7w05g049at7I3DGY5AvMcB3RUN46ILJ9+ZB5yOanoC:GEqckh8er1nzTD+3DGY5Aor9

  Score

  8^/10

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral5behavioral6

• • Target

    test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

  • SSDEEP

    98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB

  Score

  10^/10

  wannacrydiscoverypersistenceransomwarespywarestealerworm

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Executes dropped EXE

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7behavioral8

• • Target

    test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe

  • Size

    3.6MB

  • MD5

    743a6891999db5d7179091aba5f98fdb

  • SHA1

    eeca4b8f88fcae9db6f54304270699d459fb5722

  • SHA256

    fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f

  • SHA512

    9edef033663c828536190332ec87ac0096ffddae934d17c51b255a55ecb05774211a0edb1915c19384641befa291cfdfd2e3f878bf3b827f8b203ec1bee9dd96

  • SSDEEP

    98304:NX8jXTWmbAJDaFoKLxycZ2gzJXvXdfxs2g1ypKLC1z:NX8Dsm9ycUcv82Qy06

  Score

  10^/10

  ammyyadminflawedammyyevasionpersistencerattrojan

  • Ammyy Admin

    Remote admin tool with various capabilities.

    ratammyyadmin

  • AmmyyAdmin payload

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

    trojanflawedammyy

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral9behavioral10

• • Target

    test/main.exe

  • Size

    2.2MB

  • MD5

    5ffb3bfb8e0b0002d940ad4707d1c504

  • SHA1

    ed6402ebc9050fd7c85384ec88343c556df3a71e

  • SHA256

    aa80d3eaee384c8a0ba25b3d501dc0c83f7405190ae47877595fc63cf3161dcf

  • SHA512

    3f05b5c0c80223ecff25f7c8c6a1d6b6462e80ca918f526b6fe0e229f0c1631ea25bf0f856338551e32f8cf9a2a0c838941136cd788ae89b1826aaeeb2a2ccf0

  • SSDEEP

    49152:pgKKnU3mNr9CogZA8TPD1HEeVJ42aVdiUk/X:pgKp3mZ8tL826dv

  Score

  1^/10
  behavioral11behavioral12

• • Target

    test/main_temp.exe

  • Size

    2.6MB

  • MD5

    52bbc76cac35134534361c33a583b87a

  • SHA1

    45db17d6796da108f3f6bdb89f04365ae7d488ee

  • SHA256

    d26349b86c9428c0c18df9403b85d2443b866b0e7b99a4a1c8254bd0155326fd

  • SHA512

    9cb6821313018064887a635f74512d947a8425f7093f6284aab776d87eb3914b012156e51fce7f8911daf8d66fdeaa4e6206b3d621ed380c547a1c3c2d0bcbc1

  • SSDEEP

    49152:6MIov1vHrb/T4vO90dL3BmAFd4A64nsfJLi4GLCagOv8KIWnDD1codmS373a1WCE:zI8vTM3xDFLK1j4q6

  Score

  1^/10
  behavioral13behavioral14