Extracted

• • Target
    RRV2 - BOCAN V03140P26070001.jse
  • Size 155KB
  • SHA256 fc78ff65e07439abeb5dda84cac5ed8e101984e56e01955f332b6fd11dfa0f8b
  • MD5 24fb9dd9be6f3fb961fb8ef1fc60e6b6
  • SHA1 979e1a4677cb42649c473e4888cddc0847e50ab2
  • SHA512 98d65c7a61ef4913f87f01e9ef915d27339679c654e505833113e2b3c4098f3aa72313e590b18d1713c20ae9322554fb9e08ba772e4bf5f4029b8d0a840da083
  • SSDEEP 3072:o3cZBnKzvdVbDqR+rjxR1xk85P0oZ7jPj0JMMk1Mi3LnNkkrqImr6pc1o7OGA6:cSKjdtnNkzrqcmbh
  • TLSH
    T11AF3124C56D1A44C03E7DB7A362E70D9F59A0CCA69C4844EE614F8D1F6F4706EEE0AB2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionpersistenceadwareransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2