Extracted

• • Target

    Lorex.AdluminInstaller.msi

  • Size

    6.5MB

  • MD5

    ba9f849e3c6e57316548367f0f6a444b

  • SHA1

    34b80863cddfd512be800f366f282eb58fdfc640

  • SHA256

    dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2

  • SHA512

    93c324b2849e9642de25370d3e73f246384f00c2ef49c2d624f495447b856e4a74911066779650a35249bd8518cf4b4944c168982c3613f29f6a9405b74aa21d

  • SSDEEP

    98304:ZiWF9TZpfEK0lk5xmY7aRGm7XCiiQO95anWA25u2tEYjTMy5rp5WpiSvv:r91pSlkqFGICii15HrgYjTMIrfWESvv

  Score

  10^/10

  jigsawwannacrydiscoverypersistenceransomwarespywarestealerworm

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Blocklisted process makes network request

  • Modifies extensions of user files

    Ransomware generally changes the extension on encrypted files.

    ransomware

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1