General
- Target 1e7c0f7091e8ed3687b06556cbbda638af99e35d372ba257cedb8ada4b2c43fe.exe
- Size 313KB
- Sample251013-28clvabm6x
- SHA256 1e7c0f7091e8ed3687b06556cbbda638af99e35d372ba257cedb8ada4b2c43fe
Score
9/10
Malware Config
Targets
-
- Target 1e7c0f7091e8ed3687b06556cbbda638af99e35d372ba257cedb8ada4b2c43fe.exe
- Size 313KB
- SHA256 1e7c0f7091e8ed3687b06556cbbda638af99e35d372ba257cedb8ada4b2c43fe
Score9/10-
Renames multiple (10220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops desktop.ini file(s)
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry