Extracted

Extracted

• • Target
    0ec2fc63858d651699c9e5f1793f9548df783e916e72900e9cdd30b853413a6e.exe
  • Size 707KB
  • SHA256 0ec2fc63858d651699c9e5f1793f9548df783e916e72900e9cdd30b853413a6e
  • MD5 edcd84ef7afda21027ec983d65aa3ff3
  • SHA1 578fa6babcc5b8ca531006837cd639164a6e19de
  • SHA512 7606c8cab0292fd1dc87f03c8ff30c0e33aadad66d0d73b73d84eea753024bc9ee03435ad4244230b990a60ab39d5ced532df9e5e9b4996cd782b8a4e1347511
  • SSDEEP 6144:wcmwdMZ0aq9arLKkdMqJ+VYg/5ICAAQs+d5zSTamgEoOFzxLza1M83vnh:6uaTmkZJ+naie5OTamgEoKxLW/fh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  evasionpersistenceransomwaretrojan

  • Deletes NTFS Change Journal

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Clears Windows event logs

    evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (2892) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2