General
- Target FadeSEC_test.exe
- Size 645KB
- Sample260721-vbamnax1by
- SHA256 8454f2426633a9dc32d1492604027b79caad481a95b42dd2b9fd56ed799983ef
Score
9/10
Malware Config
Targets
-
- Target FadeSEC_test.exe
- Size 645KB
- SHA256 8454f2426633a9dc32d1492604027b79caad481a95b42dd2b9fd56ed799983ef
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1