Extracted

• • Target
    4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29.exe
  • Size 1.8MB
  • SHA256 4ed176edb75ae2114cda8cfb3f83ac2ecdc4476fa1ef30ad8c81a54c0a223a29
  • MD5 18498b1ff111ee9d9a037c280f75b720
  • SHA1 0e9a47782e39741a2c161bf639252d33ad3a428a
  • SHA512 c578122532d223d55a752f89bc72a22127e791d967728cbd527df54cd5aac1471642183aa4a29f310646679eb753919a2ac02b9b51437bb504dd48e24211d80a
  • SSDEEP 24576:jZgTpNZ+WIp82mx6gq+Jn5tNj32+t40VzQJSGR8cknOuP3S+hpDTFMs2UWz7vs75:WbnbdG+t40VzMSGR8zdpDTKs2N7YJlF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwarecredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (2666) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes System State backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1behavioral2