Extracted

Extracted

• • Target
    MEMZ-Destructive.bat
  • Size 315KB
  • SHA256 3fb88d8d475242a0d558b2bcce405254ea386844274d80ece0eab1780efa529d
  • MD5 d1494de6a497151197f3e3c2db31fe43
  • SHA1 76b20ec1fd7517100a4bcc049864923358071548
  • SHA512 c93195e4054439c4992edf6ff710a1b822123a29ce5198ebd84ebeb5713e719253117b366bbd30e6525a5aef9529b1a0673ecd6dfb68b7df42f366553d44b6f2
  • SSDEEP 6144:48vKn54IMdW0VxkHMAfarZ1OF4Hwk29QmfmJARqbLmutcMZJT3CqbMrhryf65NRo:pvKn54IMdW0VxkHMAfarZ1OF4Hwk29QB
  • TLSH
    T1A264A470B234A67D422B5AC6F3706714B2AAF31BD28949E0A97FD3B457C2DD4FA43058
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorbootkitcredential_accessdefense_evasiondiscoveryfantomgandcrabinfinitylockmacromacro_on_actionpersistenceransomwarespywarestealer

  • Family: Fantom

    Ransomware which hides encryption process behind fake Windows Update screen.

    ransomwarefantom

  • Family: Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Family: InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock

  • Renames multiple (1171) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1