General
- Target ca.jpeg
- Size 68KB
- Sample260714-pffftaev3v
- SHA256 afcb0416c0ad0fcca38abbecdf35eea87309845d204c13a3a395240a7f15329b
Score
9/10
Malware Config
Targets
-
- Target ca.jpeg
- Size 68KB
- SHA256 afcb0416c0ad0fcca38abbecdf35eea87309845d204c13a3a395240a7f15329b
Score9/10-
Renames multiple (6119) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1