Extracted

• • Target

    821d57d8c4f9d1f10c3ac8a8a095b0b2d7fcb463991904f2012265ca6592e24c.sample

  • Size

    250KB

  • MD5

    34b6a2858b32f25433101d72705f1421

  • SHA1

    55e31f9c1ca8dd03cb924631d371d0fb5a08bf6a

  • SHA256

    821d57d8c4f9d1f10c3ac8a8a095b0b2d7fcb463991904f2012265ca6592e24c

  • SHA512

    18fa6de0d483036f52e7997494ee5da3a5a79f7f27be3e40fec630297f7be702a048a30caa3ddb0a0f8a026f49beceb94218243753f0599b862b9cf1ac94adce

  • SSDEEP

    6144:qa0Y9MHhZhPMgjlBmXn1DxttmQIWqgYfI5CeDo:qoeNjrUn1tt/pqio

  Score

  10^/10

  discoverypersistenceransomwarespywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2