Overview

overview

10

Static

static

10

_eab74cb48...d2.ps1

windows10-2004-x64

10

_eab74cb48...d2.ps1

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    _eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2.txt
  • Size 7KB
  • Sample250802-eptdxsxpy4
  • SHA256 eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwaredefense_evasionexecutionimpactpersistenceransomwarespyware

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://wallpapercave.com/uwp/uwp4766244.png

Extracted

Path

  • C:\Users\Admin\Desktop\IMPORTANT.txt

Ransom Note
  • ALL YOUR IMPORTANT FILES ARE ENCRYPTED BY THE RANSOMWARE POWERLOCKER 5.4 WITH A POWERFULL AES-256 ENCRYPTION METHOD Rules: 1. DO NOT CHANGE THE FILE EXTENSION AND NAME OF YOUR FILES OR YOUR FILES WILL BE LOST FOREVER 2. DO NOT USE ANY THIRD-PARTY SOFTWARE FOR DECRYPT YOUR DATA OR YOUR DATA CAN BE LOST FOREVER But I promise you that all your files will be decrypted if you make the next steps. 1. Write a email to [email protected] 2. In the email say that you were infected with the PowerLocker5.4 ransomware. 3. We will negociate the ransomware decryption software. And that's all :)

Targets

    • Target
      _eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2.txt
    • Size 7KB
    • SHA256 eab74cb48e2926577d16ea10695b75185ca6c4b36f365c117e1cabe4900c6cd2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    adwaredefense_evasionexecutionimpactpersistenceransomwarespyware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks