General
- Target FadeSEC.exe
- Size 661KB
- Sample260720-s753bse15j
- SHA256 c6b4961f17f1fca46b469787189021a26349cc9aaeb6abf16badfd15dc5b8707
Score
9/10
Malware Config
Targets
-
- Target FadeSEC.exe
- Size 661KB
- SHA256 c6b4961f17f1fca46b469787189021a26349cc9aaeb6abf16badfd15dc5b8707
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1101) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1