General
- Target 2025-09-05_e8c19bf10d044fe448a60e3fa0f60d58_cobalt-strike_snatch
- Size 2.0MB
- Sample250905-2tpb4acq8w
- SHA256 1942510d3b5691819636067ec89b7b7bb18f784d819060d687fc0248dbed5047
Score
9/10
Malware Config
Targets
-
- Target 2025-09-05_e8c19bf10d044fe448a60e3fa0f60d58_cobalt-strike_snatch
- Size 2.0MB
- SHA256 1942510d3b5691819636067ec89b7b7bb18f784d819060d687fc0248dbed5047
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (17273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1