Extracted

• • Target
    _424dd1d53d189a4ffd5af0365a70ee422d09bbec1a253773dd34255ecb2c2137.txt
  • Size 6KB
  • SHA256 424dd1d53d189a4ffd5af0365a70ee422d09bbec1a253773dd34255ecb2c2137
  • MD5 794f73b1725711df5c2f879e5b9d9706
  • SHA1 aad43d93a8f21abadf36fca62794e94b0c86a2e9
  • SHA512 88cea7b8c278775c4f009386e44a954280ac7f510fa4f76a84db6f882007bcf8c0f9fc48719abd7f23e232ca83eec1db9f3bdff9981743c7f90032e312e875dd
  • SSDEEP 192:sl6tduK2rCsX+JfWXwyG4EVtWcPUXGzh0RBlshbDU2fC31N6:sl/uJeAP3B9
  • TLSH
    T117D1C719AA136511D533437AC8D57058ED3E081B2953316835DCA2E8AFBA9BDC3C6FCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistenceadwarediscoveryransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2