Extracted

• • Target

    sample.mlw

  • Size

    736KB

  • MD5

    5a1804824fc4a96108c80395a5125e7a

  • SHA1

    e115abc31a19978a02f290bb0a6b5edd59914423

  • SHA256

    73b0acba1d279c5810afb1e0d28a71c9625f722014bab94e0f957d660e801e49

  • SHA512

    25f4fd5adfa9ecca55b2310848a842c7737d67368a35a36c60291eb27c4401b0e882eb866c193bf31d8cfae4ef452f917a1bf66713b1b89684476c4bb427ddd7

  • SSDEEP

    12288:pTeD/3svKWr7TRSvvMYswG7hdGd1+xcI2YG0PDPhWTuFpzNm7KJJ8V449HL2dV:pTysCW7MHtehr8YG2muFpz2PP9HLoV

  Score

  10^/10

  djvuffdroidermicrosoftdiscoveryevasionpersistencephishingransomwarespywarestealertrojanupx

  • Detected Djvu ransomware

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Renames multiple (180) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates new service(s)

    persistence

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies RDP port number used by Windows

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers COM server for autorun

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1