General
- Target FadeSEC.exe
- Size 691KB
- Sample260720-tx7c3sgs5j
- SHA256 41223503f3b552b57b9b653364a0b1f62c324435322b812a0cfc64ac13a3ceff
Score
9/10
Malware Config
Targets
-
- Target FadeSEC.exe
- Size 691KB
- SHA256 41223503f3b552b57b9b653364a0b1f62c324435322b812a0cfc64ac13a3ceff
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1120) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1