25d76e42b582390a29bc369916dd3a984879bd9fbd56f78ca04cf852a835f066

General

Target
pickles.exe
Size 7.8MB
Sample260606-mpqa9sdv3m
SHA256 25d76e42b582390a29bc369916dd3a984879bd9fbd56f78ca04cf852a835f066
MD5 471ad5262fb86cce556c1a7d6bf8d723
SHA1 81eca563e5f0ea68297dfcde8b1d728bc72f6bbb
SHA512 ee0f54748352a6f23402826cefa6c7ba2765e1e5e9822133f5a4482b6141e7171c61a2f1c20680a63c3a4b2983439f662f3434a11596d1025d862f5a6efadc9c
SSDEEP 196608:gBNTwhLyzA1HeT39IigbauDXURuAEk0ax8ZmG:gWLyc1+TtIihuARuAUax6mG
TLSH
T1B386339592B104E9E9F7863E8362C10CE1A3749B4766C2DF27E006972F27BE14D3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  pickles.exe
- Size 7.8MB
- SHA256 25d76e42b582390a29bc369916dd3a984879bd9fbd56f78ca04cf852a835f066
- MD5 471ad5262fb86cce556c1a7d6bf8d723
- SHA1 81eca563e5f0ea68297dfcde8b1d728bc72f6bbb
- SHA512 ee0f54748352a6f23402826cefa6c7ba2765e1e5e9822133f5a4482b6141e7171c61a2f1c20680a63c3a4b2983439f662f3434a11596d1025d862f5a6efadc9c
- SSDEEP 196608:gBNTwhLyzA1HeT39IigbauDXURuAEk0ax8ZmG:gWLyc1+TtIihuARuAUax6mG
- TLSH
  T1B386339592B104E9E9F7863E8362C10CE1A3749B4766C2DF27E006972F27BE14D3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  bsod_looper.pyc
- Size 13KB
- SHA256 f9a811503eae9382745f6b56342bd205ad14ef53de9b0860a3a494084099eaed
- MD5 57dbf8da7502feb37108c6a8aed3799c
- SHA1 48d581c1d343702e09f35ac420a48f29af8924df
- SHA512 3397aebc5b4594e62ab195a5c87387f1b715e57585cfe63857fcbf9a9b15046612cad2931228d4f421e5dca010fac3ac619483c4efb4e291b5a0292598f3fc0c
- SSDEEP 192:4nghmqLf4+eQ6DQS4nNAB8hZVoilCj30F6MWTThwEG/m:Eg/Lf4+eQ6BuNhfoiakF4yH/m
- TLSH
  T1865273923B83C976FC48A372441667663365C8E8F324C3C735BBA0265D4A5E42D762CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral2