d924926446eff5ea2f185c29a92b2e1e62bdacd630dd33137e6e35df6fd4735e | Triage

Sharing

General

Target

scarey.exe
Size

15.3MB
Sample

250328-wqv3kszscs
MD5

29805ee1be108e4c41b300c90f0c645c
SHA1

8d369ce4e631d79a92a0774ccc8ca1083fce84e5
SHA256

d924926446eff5ea2f185c29a92b2e1e62bdacd630dd33137e6e35df6fd4735e
SHA512

5dc878ea99be940cfe1bc057def3a61e0486b26905fb9660d50d76144a48a5adb239e8b21fc937670be0e49f2353257ba08f485bb6c969d74a2b50b84a055d99
SSDEEP

393216:HHW8Uwq3Obs2CltXMCHWUjZVg74w/ADF5ILf5kvsWP:nW8Uwq3ObRqtXMb8rDw/KLILf5kvLP

Score

9^/10

credential_access defense_evasion discovery execution impact pyinstaller ransomware spyware stealer

Malware Config

Targets

- Target
  
  scarey.exe
- Size
  
  15.3MB
- MD5
  
  29805ee1be108e4c41b300c90f0c645c
- SHA1
  
  8d369ce4e631d79a92a0774ccc8ca1083fce84e5
- SHA256
  
  d924926446eff5ea2f185c29a92b2e1e62bdacd630dd33137e6e35df6fd4735e
- SHA512
  
  5dc878ea99be940cfe1bc057def3a61e0486b26905fb9660d50d76144a48a5adb239e8b21fc937670be0e49f2353257ba08f485bb6c969d74a2b50b84a055d99
- SSDEEP
  
  393216:HHW8Uwq3Obs2CltXMCHWUjZVg74w/ADF5ILf5kvsWP:nW8Uwq3ObRqtXMb8rDw/KLILf5kvLP
Score

9^/10

credential_access defense_evasion discovery execution impact ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (258) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Windows Credential Manager

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

credential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer