Extracted

Extracted

• • Target

    Steam.sfx.exe

  • Size

    1.5MB

  • MD5

    12eb750a2a4ff29b596d97592b219757

  • SHA1

    40aedee5578686295805f9f23363551b8da73ba2

  • SHA256

    ce62a35f91e421ff693bde07a223cd079359f1e7f2d942aca0884dda287d3bf3

  • SHA512

    fdc38207c2715d6a7ce817a0d1929b6f2432a79fb739b16968372fe679c7a4b95fafcfbf6341b1bd0fdfec3256b582ba889c9ffd37d425872005e242766df7ae

  • SSDEEP

    24576:KEeqQq3KZUyJ183CcshguRr5BnzgGa22P+jasRZDQt:KEuq6/1gshguRr5x9jlRZDQt

  Score

  10^/10

  neshtawannacryxwormdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealertrojanworm

  • Detect Neshta payload

  • Detect Xworm Payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1