521e714bdc7fdbdc9789aaac1beec6ca63b936e613bc606e2c341d1d8ced64d0

General

Target
SF-Verif.exe
Size 5.9MB
Sample260620-rfntasgx7y
SHA256 521e714bdc7fdbdc9789aaac1beec6ca63b936e613bc606e2c341d1d8ced64d0
MD5 52fa7af4aca3c59e62d731460f86502e
SHA1 a9fe6cbb68d05f4710b2122ffc0b886af310e5b7
SHA512 5af7f0a695eec1ddf4aa08f60ebb9104f3e70e8abb99fd66d3f051d7fa81b37725562359af1774999bb79b7a5fdbd447ca58f4d0dd63ab4493654e7ad4e96bbb
SSDEEP 98304:cRQh83E1fnf7TN+c8Wl6B+Ip9L1P00wbPRTiZfI8E6dnH+Rz664l:cRQh83EdTTN+c8WlIxhP0VROZAR6dnC0
TLSH
T1FF56013AF716484AF02F037B4592D3A5C5512B80E635A2E706B1AF53BAF35C21FA5EC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SF-Verif.exe
- Size 5.9MB
- SHA256 521e714bdc7fdbdc9789aaac1beec6ca63b936e613bc606e2c341d1d8ced64d0
- MD5 52fa7af4aca3c59e62d731460f86502e
- SHA1 a9fe6cbb68d05f4710b2122ffc0b886af310e5b7
- SHA512 5af7f0a695eec1ddf4aa08f60ebb9104f3e70e8abb99fd66d3f051d7fa81b37725562359af1774999bb79b7a5fdbd447ca58f4d0dd63ab4493654e7ad4e96bbb
- SSDEEP 98304:cRQh83E1fnf7TN+c8Wl6B+Ip9L1P00wbPRTiZfI8E6dnH+Rz664l:cRQh83EdTTN+c8WlIxhP0VROZAR6dnC0
- TLSH
  T1FF56013AF716484AF02F037B4592D3A5C5512B80E635A2E706B1AF53BAF35C21FA5EC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Executes dropped EXE
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1