General
- Target FadeSEC.exe
- Size 695KB
- Sample260722-y1keyazwct
- SHA256 b1f5e68acca904d9c00a4c008c898faca5d8be31d9efa81da7dc883c45d2da48
Score
9/10
Malware Config
Targets
-
- Target FadeSEC.exe
- Size 695KB
- SHA256 b1f5e68acca904d9c00a4c008c898faca5d8be31d9efa81da7dc883c45d2da48
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1