947af9aaf060990af6481db8d265fa739c21a9edeae56bd5281807c7792e0e09

General

Target
new.exe
Size 253KB
Sample260705-nyk9cacs2w
SHA256 947af9aaf060990af6481db8d265fa739c21a9edeae56bd5281807c7792e0e09
MD5 655036aed66399e3bf1b44c5dfaeac05
SHA1 c827bc207e55bc9548f9037ff8af276c0c1fc35e
SHA512 63c7ebdb230c65107cd8913f6ca007a1be44ce385cbf9d3c44cf4f8a6efef983cd5f77d5ec0a2656b18609ab73efafc641e1d525d995b6e6937c6e43894285bf
SSDEEP 3072:qbbGOtg9R53JxVl3/eLfMMepP/v6CjLKulVDC/AL/kxBIU1wrYBJHGLETUYu:qb9q3JxPveYbXLlUKYkYBJgLYu
TLSH
T148446C5AA6A408FCECB7D17EC9A14A06E772BC460730D6DF03A052671F276D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  new.exe
- Size 253KB
- SHA256 947af9aaf060990af6481db8d265fa739c21a9edeae56bd5281807c7792e0e09
- MD5 655036aed66399e3bf1b44c5dfaeac05
- SHA1 c827bc207e55bc9548f9037ff8af276c0c1fc35e
- SHA512 63c7ebdb230c65107cd8913f6ca007a1be44ce385cbf9d3c44cf4f8a6efef983cd5f77d5ec0a2656b18609ab73efafc641e1d525d995b6e6937c6e43894285bf
- SSDEEP 3072:qbbGOtg9R53JxVl3/eLfMMepP/v6CjLKulVDC/AL/kxBIU1wrYBJHGLETUYu:qb9q3JxPveYbXLlUKYkYBJgLYu
- TLSH
  T148446C5AA6A408FCECB7D17EC9A14A06E772BC460730D6DF03A052671F276D19D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence ransomware bootkit credential_access spyware stealer
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Renames multiple (204) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Modifies boot configuration data using bcdedit
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3 behavioral4