Extracted

• • Target
    media_images_grubyptok.jpg
  • Size 149KB
  • SHA256 f9197ec99fb6cfccca9b5ad6af20c455f7e0b5cf15c9baf197164b2e6f7bfe78
  • MD5 26a2c7b4bddada15f52a82e4b8a1a4a1
  • SHA1 12d0ffae14529df8e771db4fff4e13b6ba56008d
  • SHA512 b99c657f18d79b8154752d4c995d8c768bffd6a0358eb5be7c2cff9d26dd2946c59c64fd91d70fe8cb3417dd129d288c474626bebceb6b54d8566cb0c5d469c5
  • SSDEEP 3072:C2GgAUugk4mxDZnm1u6PMJW+vvRo/tx5vKqR/V+UyTA05ydd:CzLJxDZn2u94+vG/tx5yqZV+UyTA05e
  • TLSH
    T169E3239E1D8A56EB659C3014E532128F76016BF919F460B900B8EFD4EC116ACF1E37AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistenceransomware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1