General
- Target ef8892652c9731aeefd8178fd257446fa617f32e2bdc19f33aaf49a5d6eb2ee4.zip
- Size 32KB
- Sample260628-tdfe9ah13v
- SHA256 03ec6ead4ecb029d22e0138cc2ebe417cea7bb1d0a67296841a2d71584b03d97
Score
9/10
Malware Config
Targets
-
- Target ef8892652c9731aeefd8178fd257446fa617f32e2bdc19f33aaf49a5d6eb2ee4
- Size 78KB
- SHA256 ef8892652c9731aeefd8178fd257446fa617f32e2bdc19f33aaf49a5d6eb2ee4
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (68) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Adds Run key to start application
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2