Overview

overview

10

Static

static

6

DUMP_00A10...iR.exe

windows7-x64

7

DgH5SjZFle...DI.exe

windows7-x64

10

Dumped_.exe

windows7-x64

7

EntrateSetup.exe

windows7-x64

9

ErrorFileRemover.exe

windows7-x64

10

ExtraTools.exe

windows7-x64

7

F45F47EDCE...54.exe

windows7-x64

10

decrypt_00...00.exe

windows7-x64

6

dffde400ad...3d.exe

windows7-x64

10

dircrypt.deobf.exe

windows7-x64

10

dma locker 4.0.exe

windows7-x64

9

downloader.js

windows7-x64

10

dump.mem.exe

windows7-x64

6

e0ff79cc94...ss.exe

windows7-x64

7

e37dc428ec...ad.vbs

windows7-x64

1

e5df2d114c...8a.exe

windows7-x64

10

e6c4ae4709...ss.exe

windows7-x64

7

e77df2ce34...2d.exe

windows7-x64

1

e8e07496df...d2.exe

windows7-x64

ea8292721a...1e.exe

windows7-x64

5

eaa857c95f...er.dll

windows7-x64

1

ed3a685ca6...91.exe

windows7-x64

9

edffa07d66...9d5.js

windows7-x64

10

encrypter.exe

windows7-x64

10

encryptor_...81.exe

windows7-x64

9

f002618c01...35.apk

windows7-x64

3

f213e54c85...ea.exe

windows7-x64

1

f2c8eee2cd...3f.exe

windows7-x64

10

f31bfe95e3...7_.exe

windows7-x64

7

f6a8d7a429...da.exe

windows7-x64

10

f915110765...da.exe

windows7-x64

7

fb8823e949...-0.dll

windows7-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Batch_7.zip
  • Size 6.8MB
  • Sample241122-dyw1qszkhp
  • SHA256 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
crypvaultponywarzoneratxoristcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\360390_readme.txt

Ransom Note
  • ATTENTION: All your documents, photos, databases and other important personal files were encrypted using strong RSA-1024 algorithm with a unique key. To restore your files you have to pay 0.5 BTC (bitcoins). To do this: 1. Create Bitcoin wallet here: https://blockchain.info/wallet/new 2. Buy 0.5 BTC with cash, using search here: https://localbitcoins.com/buy_bitcoins 3. Send 0.5 BTC to this Bitcoin address: oJHR97yvh97wrjvwlkrcnqrp79w9rvqnrvj 4. Send any e-mail to: [email protected] After that you will recieve e-mail with detailed instructions how to restore your files. Remember: nobody can help you except us. It is useless to reinstall Windows, rename files, etc. Your files will be decrypted as quick as you make payment.

Extracted

Path

  • C:\Program Files (x86)\Internet Explorer\en-US\ReadMe.html

Ransom Note
  • <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>&#10102;<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>&#10103;<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 0582710216</big></h1></center> </div> </div> </body> </html>
URLs

  • http-equiv="content-type">

  • http://rktazuzi7hbln7sy.onion/<br>

Extracted

Path

  • C:\Program Files (x86)\Internet Explorer\en-US\ReadMe.txt

Ransom Note
  • jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 0582710216
URLs

  • http://rktazuzi7hbln7sy.onion/

Extracted

Family

  • pony

C2

  • http://startwavenow.com/gate.php

  • http://hollandfintech.net/api/gate.php

Extracted

Family

  • warzonerat

C2

  • 195.140.213.91:5200

Extracted

Path

  • C:\Users\Admin\Documents\READ_THIS_TO_DECRYPT.html

Ransom Note
  • <html> <head> <title>-</title> <style> html {font-family:Consolas;font-size:20px;background-color:lightgrey;} div{ margin:0 auto 15px auto; border:1px solid; background-color:grey;} p,h3{ text-align:center; color:white; } #R{background-color:darkred;} button{padding:10px 15px; margin:15px;} </style> </head> <body> <div> <h3>YOU PERSONAL FILES HAS BEEN ENCRYPTED</h3> <p>-</p> <p>Your data (photos, documents, databases etc.) have been encrypted with a private and unique key generated for this computer. This means that you will not be able to access your files anymore until they are decrypted. The privete key is stored in our servers and the only way to receive your key to decrypt your files is making a payment.</p> </div> <div> <p>The payment has to be done in Bitcoin to a unique address that we generated for you. Bitcoins are the virtual currency to make online payments. If you don't know how to get Bitcoins, you can click the button "How to buy Bitcoins" below and follow the instructions. If you have problem with this task use internet.</p> <p><abbr style="color:red;background-color:black;">You have only 1 week to submit the payment.</abbr> When this time ends, the unique key will be destroyed and you won't be able to recover your files anymore.</p> </div> <div id="R"><h3>YOUR UNIQUE KEY WILL BE DESTROYED IN 1 WEEK FROM ENCRYPTION!</h3></div> <div> <p>To recover your files, you must send 0.1 Bitcoins ( ~$37 ) to the next Bitcoin address:</p> <p><abbr style="background-color:white;font-size:35px;color:black;">15F5FM7qMhLQ44RDxuozbKRwSbHKmq7N39</abbr></p> <a target="_blank" href="https://bitcoin.org/en/getting-started"><button>How to buy Bitcoins #1</button></a> <a target="_blank" href="https://en.bitcoin.it/wiki/Buying_Bitcoins_(the_newbie_version)"><button>How to buy Bitcoins #2</button></a> </div> </body> </html>

Targets

    • Target
      DUMP_00A10000-00A1D000.exe.ViR.exe
    • Size 52KB
    • SHA256 2c4c8066a1a7dfdf42c57ff4f9016f1ba05bcb004ff8b0ffc0989165d2ad30e2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceupx

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1
    • Target
      DgH5SjZFleOYoBTyxcgMDlZF9brN1mDI.exe
    • Size 176KB
    • SHA256 ebea4a46175b0e9c24e74b774f9ecfb036030f916ec5f2fced34fcb6c1f3ba57
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral2
    • Target
      Dumped_.exe
    • Size 72KB
    • SHA256 86a4ec02684bfd8a055929b0aa6f687bd54e80da0ed689be4e315adf76edbbcb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral3
    • Target
      EntrateSetup.exe
    • Size 261KB
    • SHA256 103bc884dce60ec680dd00bcd2d45721319b526b2f6ae7ebe75c73a5c977dafe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan
    behavioral4
    • Target
      ErrorFileRemover.exe
    • Size 2.4MB
    • SHA256 68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoverypersistence

    • Modifies WinLogon for persistence

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral5
    • Target
      ExtraTools.exe
    • Size 280KB
    • SHA256 06c8e0f6fa2616f4fa92c610a1faea23887ac31db8fa78cede49b6b8c80ec22f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    behavioral6
    • Target
      F45F47EDCED7FAC5A99C45AB4B8C2D54.exe
    • Size 86KB
    • SHA256 0529cdbc893fee664d3ac540b1e41e184797e0770808254058fc21de0a10b6c8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral7
    • Target
      decrypt_0000000000000020-000A0000.exe
    • Size 611KB
    • SHA256 94f36b586379137a58862ca46cd1cd6c01c20ea9f56755f7b193f0c97b7a57bd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistence
    behavioral8
    • Target
      dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
    • Size 182KB
    • SHA256 dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    crypvaultponycollectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer

    • CrypVault

      Ransomware family which makes encrypted files look like they have been quarantined by AV.

      ransomwarecrypvault

    • Crypvault family

      crypvault

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Deletes itself

    • Drops startup file

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of SetThreadContext

    behavioral9
    • Target
      dircrypt.deobf.exe
    • Size 321KB
    • SHA256 9c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral10
    • Target
      dma locker 4.0.exe
    • Size 315KB
    • SHA256 53a0dc85e447c58cb8d7c7e00381c8548878390c7a1443326625faa2b461ebe8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryexecutionimpactpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral11
    • Target
      downloader.js
    • Size 8KB
    • SHA256 f6e2c1b42ce68165fd2cd8580daf47d594c4960fc8fb5cdbf1ec210e3ffae87f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionransomwarespywarestealer

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral12
    • Target
      dump.mem.exe
    • Size 53KB
    • SHA256 ea3745e02a69f4123e06115b3abeb8dc6930000ed97d8a55351641b76b4d5e1a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discoverypersistence
    behavioral13
    • Target
      e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32_not_packed_maybe_useless.exe
    • Size 89KB
    • SHA256 e0ff79cc943f489668067ec3be11398a084a76ecd0283c9e18b2d0bf6e464c32
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral14
    • Target
      e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad.exe
    • Size 54KB
    • SHA256 e37dc428ec65a38707ad9e247950f3501a94e4abccb737a3562d69032c8505ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15
    • Target
      e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a.exe
    • Size 33KB
    • SHA256 e5df2d114c5f69c219923fed56c8aa7ee912020ba7589e88f2729285c1f5788a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryransomwarespywarestealer

    • Renames multiple (4027) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral16
    • Target
      e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc_not_packed_maybe_useless.exe
    • Size 54KB
    • SHA256 e6c4ae470977aa78d1005746ae05deea0bf3b4260f88865662a35f99b2559dbc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral17
    • Target
      e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d.exe
    • Size 196KB
    • SHA256 e77df2ce34949eb11290445a411a47fb927e8871e2580897581981d17730032d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18
    • Target
      e8e07496df5370d2e49ecce5a47c1fd2.exe
    • Size 181KB
    • SHA256 63b541a11d8389b13c634665ba72437270cd8bbbbc3df7dc43acfe201a5a67e5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xoristdiscoverypersistenceransomwarespywarestealerupx

    • Detected Xorist Ransomware

    • Xorist Ransomware

      Xorist is a ransomware first seen in 2020.

      ransomwarexorist

    • Xorist family

      xorist

    • Renames multiple (2558) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops file in Drivers directory

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral19
    • Target
      ea8292721a34ca2f1831447868bbe91e.exe
    • Size 52KB
    • SHA256 21c0601f225087fa6d36ed951e0328bcbd2138bcea6a413162d1a8e17b0cb179
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Suspicious use of SetThreadContext

    behavioral20
    • Target
      eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d_Stealer.exe
    • Size 949KB
    • SHA256 eaa857c95fca38ca08411b757f4ad2a841cfb9782deca8abf64aada445923c0d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21
    • Target
      ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791.exe
    • Size 1.2MB
    • SHA256 ed3a685ca65de70b79faf95bbd94c343e73a150e83184f67e0bdb35b11d05791
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryexecutionimpactransomwarespywarestealer
    behavioral22
    • Target
      edffa07d667dbd224682639f56eb1b913e4ffeac874999e02c23e86eeb6489d5.exe
    • Size 559KB
    • SHA256 edffa07d667dbd224682639f56eb1b913e4ffeac874999e02c23e86eeb6489d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ponycollectioncredential_accessdiscoveryexecutionpersistenceratspywarestealer

    • Pony family

      pony

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Executes dropped EXE

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral23
    • Target
      encrypter.exe
    • Size 40KB
    • SHA256 3251403ff9848ed520230a0fb8979ea4b5c8a4aa4e4a392da4c4458390f040db
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral24
    • Target
      encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe
    • Size 111KB
    • SHA256 d4410c277e4120169a546d613d06b6f1ca1c09ea94494baeb0af796bfaefeefa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
    behavioral25
    • Target
      f002618c01fe652f7f00eabd0e890e4992ccce818dfb2863e82c43f793685635.exe
    • Size 1.0MB
    • SHA256 f002618c01fe652f7f00eabd0e890e4992ccce818dfb2863e82c43f793685635
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral26
    • Target
      f213e54c8520e7458751020edf15a5ea.exe
    • Size 208KB
    • SHA256 2cd85dc5040ecbc052bb243575c8f9924afafdbf774a21afe03d2d4896e5d0e1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27
    • Target
      f2c8eee2cd88b834e9d4c0eb4930f03f.exe
    • Size 809KB
    • SHA256 0cc95d376267ae78c309fd5f60f3083670b1c2616b6e3e2eec8810fa273c24be
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    warzoneratdiscoveryinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral28
    • Target
      f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7_.exe
    • Size 689KB
    • SHA256 f31bfe95e31d761459b885052d35ba5e25ab19333378fb72b12efd675f6018d7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral29
    • Target
      f6a8d7a4291c55020101d046371a8bda.exe
    • Size 799KB
    • SHA256 082060e3320870d1d576083e0ee65c06a1104913ae866137f8ca45891c059a76
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryransomware

    • Drops startup file

    behavioral30
    • Target
      f9151107655aaa6db995888a7cb69ada.exe
    • Size 360KB
    • SHA256 b70c528731e7fa31c6038f26a07f48a0436741162961922d9bba468f77b3ce0f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoveryspywarestealer

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral31
    • Target
      fb8823e9494016f59ab25ec6cc0961da_api-ms-win-system-softpub-l1-1-0.dll
    • Size 261KB
    • SHA256 3b6cdb0d03f07af774ea34a964a6e2fb6ce321d7adc487af0486f13e5aed0304
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Direct Volume Access

1
T1006

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

11
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

4
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

2
T1114

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

3
T1490

Tasks

static1

upx
Score
6/10

behavioral1

discoverypersistenceupx
Score
7/10

behavioral2

discoverypersistenceupx
Score
10/10

behavioral3

Score
7/10

behavioral4

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan
Score
9/10

behavioral5

discoverypersistence
Score
10/10

behavioral6

discovery
Score
7/10

behavioral7

discoveryevasionpersistenceupx
Score
10/10

behavioral8

discoverypersistence
Score
6/10

behavioral9

crypvaultponycollectioncredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwareratspywarestealer
Score
10/10

behavioral10

discoveryevasionpersistencetrojanupx
Score
10/10

behavioral11

defense_evasiondiscoveryexecutionimpactpersistenceransomware
Score
9/10

behavioral12

executionransomwarespywarestealer
Score
10/10

behavioral13

discoverypersistence
Score
6/10

behavioral14

discoverypersistence
Score
7/10

behavioral15

Score
1/10

behavioral16

defense_evasiondiscoveryransomwarespywarestealer
Score
10/10

behavioral17

Score
7/10

behavioral18

Score
1/10

behavioral19

xoristdiscoverypersistenceransomwarespywarestealerupx
Score
10/10

behavioral20

discovery
Score
5/10

behavioral21

Score
1/10

behavioral22

defense_evasiondiscoveryexecutionimpactransomwarespywarestealer
Score
9/10

behavioral23

ponycollectioncredential_accessdiscoveryexecutionpersistenceratspywarestealer
Score
10/10

behavioral24

defense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealer
Score
10/10

behavioral25

defense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer
Score
9/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

warzoneratdiscoveryinfostealerpersistencerat
Score
10/10

behavioral29

discoverypersistence
Score
7/10

behavioral30

discoveryransomware
Score
10/10

behavioral31

discoveryspywarestealer
Score
7/10

behavioral32

Score
1/10