Extracted

• • Target
    5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0
  • Size 2.8MB
  • SHA256 5bc9478d90533ebccf09c7204999853bae36db997b230e2809090c7827c8ced0
  • MD5 7aa09e4360e6f20bddf496b1a761625c
  • SHA1 69a82326b7dfd32c13aaafe6f35513041677e2bc
  • SHA512 0870390c9e2eb329ce6be788206703d31ac6ca7f9ff5a73c9cb27651845bdccce0af1b8554e5f04f45e241ca125151807e3d5dc53bf3562eab67c2fc206f37ac
  • SSDEEP 24576:x9unT88TyX8GwjLXULXr9EZZHGUPpNjgk59yjfX/AGrYum1e/Khs6apAUFc6d8Wa:zqTfTUpdLXREi8jp5E51/KWK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasionexecutionimpactpersistenceransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (164) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2