Extracted

• • Target
    file
  • Size 311KB
  • SHA256 de6b6e72e056beb9e85e59553267d3cc92c85c89e305d3252ff11cb9400d5d16
  • MD5 b9d2e08c0043103c8be40830b41abf99
  • SHA1 e983871bc055172b4fb81cb82ea7bcf8a2dea29d
  • SHA512 b0b299805918bf6f42ef2ea619b9aafccc999ff7dd612b3847f9ab846401d868e3305b487f741370938674d871e29888425c819559a4161f287799a78fdf4469
  • SSDEEP 3072:JitgAkHnjPIQ6KSEc/THWPaW+LN7DxRLlzglKGVw8k:OgAkHnjPIQBSEk2PCN7jBGVw8k
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  discoveryevasionexecutionexploitpersistenceransomwaretrojan

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Possible privilege escalation attempt

    exploit

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1