b56bd73bbab0e14131f3f941ba7edebfd5c73d9aed5cd9757d7f11d4e772220e | Triage

Sharing

General

Target

scarey.exe
Size

15.3MB
Sample

250328-vm5bea1jw8
MD5

62f69ca1a5e20ac304c5efe99fe6ac16
SHA1

3cb33642d42228335dee98f1611c527a7fe0875a
SHA256

b56bd73bbab0e14131f3f941ba7edebfd5c73d9aed5cd9757d7f11d4e772220e
SHA512

e9e0ddd0bbc42eebb742eb61bdbdd89c1916c93d7002a164babcb2168c5f03406f515becfb2a85be9b4ef57065ab4ff9975c3ef7191a5f51adb6503d4976cb0d
SSDEEP

393216:DHW8Qwq3Obs2CltXMCHWUjZVg74w/ADF5ILf5kvsWP:TW8Qwq3ObRqtXMb8rDw/KLILf5kvLP

Score

9^/10

credential_access defense_evasion discovery pyinstaller ransomware spyware stealer

Malware Config

Targets

- Target
  
  scarey.exe
- Size
  
  15.3MB
- MD5
  
  62f69ca1a5e20ac304c5efe99fe6ac16
- SHA1
  
  3cb33642d42228335dee98f1611c527a7fe0875a
- SHA256
  
  b56bd73bbab0e14131f3f941ba7edebfd5c73d9aed5cd9757d7f11d4e772220e
- SHA512
  
  e9e0ddd0bbc42eebb742eb61bdbdd89c1916c93d7002a164babcb2168c5f03406f515becfb2a85be9b4ef57065ab4ff9975c3ef7191a5f51adb6503d4976cb0d
- SSDEEP
  
  393216:DHW8Qwq3Obs2CltXMCHWUjZVg74w/ADF5ILf5kvsWP:TW8Qwq3ObRqtXMb8rDw/KLILf5kvLP
Score

9^/10

credential_access defense_evasion discovery ransomware spyware stealer
- Renames multiple (216) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

behavioral2

credential_accessdefense_evasiondiscoveryransomwarespywarestealer