Extracted

• • Target
    Captura de pantalla 2026-07-10 180505.png
  • Size 386KB
  • SHA256 79e44515dd1946b698ea6d0436d74c3fce5134f61003574276cf817684facd16
  • MD5 623cae7e306e6eaff150e9606e25ca06
  • SHA1 ff2b04d7dde99298f4482fda84c11bf1084f01f7
  • SHA512 422adbba8960508b5a21cded7a9d0f253c0a96760b790c262c97d87982495eb292eff8db8d7fcbf3daf6e7abff310b1a8d7d578edbcc906df9e3e2bc36fd4716
  • SSDEEP 12288:lTYyjeKQ0K7XhV72ICFj0k3mjJ2e77th14MtCgRE:hYyaKQRXwFwkWjJ577tT4/gRE
  • TLSH
    T1958423F46D653AEEDBBF30FB48C918C70CE61EB986295B4ED28590035B5CF066ED8101
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionexploitbadrabbitwannacryimpactpersistenceprivilege_escalationransomwarespywaresuricataworm

  • Family: BadRabbit

    Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

    ransomwarebadrabbit

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: AppInit DLLs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation

  • Possible privilege escalation attempt

    exploit

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

    Network activity triggered a Suricata alert

    suricata

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2