Extracted

• • Target

    Ff2 external.zip

  • Size

    15KB

  • MD5

    b7b23f0fb1e8d035371a4b2a7f4a6008

  • SHA1

    ff885b7b4bdbdba23e0d540f28ef4ffdf5072adb

  • SHA256

    07569cd953006587d716ee60b284baf1d77bfbd77706395b2c3b504d76267380

  • SHA512

    d0cb3406b65c157095e4ddc592d39f00a43cd8c686143ce3ead7469e29f4e80756787b479ffbecaa7f016287532efcb0e33ed3b8170ffad4573421304991bcad

  • SSDEEP

    3:vhj/NVlllUtxgEEAI2tvbGllnZ5i2Qz//Z6+4Fz/RjllNVlllUll9xgEEAI7uWlp:5jb/qTIy2TU5rc15jb/q7IqWl+lMt

  Score

  10^/10

  azorultchimerarmsaspackv2defense_evasiondiscoveryevasionexecutioninfostealerlateral_movementmacromacro_on_actionpersistenceprivilege_escalationransomwareratspywarestealertrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Chimera

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera

  • Chimera Ransomware Loader DLL

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RMS

    Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

    trojanratrms

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Renames multiple (3259) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Stops running service(s)

    evasionexecution

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon

    persistence

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion
  behavioral1

• • Target

    Ff2 external/ff2 script.exe

  • Size

    15.0MB

  • MD5

    14b17234e237505421b6492b8d757507

  • SHA1

    48eba0e45eebde154bb49322e5098cea67717de1

  • SHA256

    167b76d3a8d20df15c421d48877c330597f6309d6b55c7b5327df5d89a51423f

  • SHA512

    8275df99cc31e7b7259799b480438186513b37f4558472b22bd2e85741845e76cc0b99f1a6030222a8ee8f1098d206cdd6c1206432214bc5f3c270f93b87e92e

  • SSDEEP

    3::

  Score

  1^/10
  behavioral2