Extracted

Extracted

• • Target
    Project_Workshop_7th_Minutes.txt.lnk
  • Size 37KB
  • SHA256 12e2fd6aeee691d88791f0eea11ebbc4ad4cc2e895b69b3c186f9f9422ce7c31
  • MD5 67efc87cc9e97a8b8f1f3c0d2757e424
  • SHA1 f98d51eda6fb5068dd2109372970f156f841e9f8
  • SHA512 8178439d94dff7a30159fd2e88daac39513c4bd70f952c1433d075b1778af125bec5e4f9e430b9f7f11d0f2b012aa75c77534020e9be9663f5a4a061f139e249
  • SSDEEP 768:YXku18ju3XHu0HrcBsri4W38Ih0/Z3QHe/xGvqZS4up:Meu3edWIUd+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptowalldefense_evasionexecutionransomware

  • CryptoWall

    Ransomware family which is an improved version of the older CryptoDefense.

    ransomwarecryptowall

  • Cryptowall family

    cryptowall

  • Renames multiple (145) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2