Extracted

Extracted

• • Target
    ransomware.exe
  • Size 11.6MB
  • SHA256 fc434b99b49d02aa6c0adec798379894158e3d6ce92c869964a6b421d106bba8
  • MD5 460efc301c54085952e9e9811c80b653
  • SHA1 4d15b0a52bc029d7dd736b83e7be378a337a260e
  • SHA512 4e5d0be050424f460172a84dd3074bc21b32ecf17c436fc4c41d6bf367ab647da27ab501ea19e2a57f16a3634f3d81d108d12bf23b242e7fade6962a8ca885a8
  • SSDEEP 196608:F6nhcd3w0AE2gWXEpXnH2ph1iut1/1QpL0uQg+xeukjUtK7voKgpVFBZ3:yhA1F2gWXEAphVtrQSg+xeXjUK7vFgtB
  • TLSH
    T1F1C63398739909E8F8BA413C6CC0CA2393E1B8612BA5D2EB17F14C551D372D9EF74B91
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutionimpactransomwarebackdoordiscoverymetasploitxmrigminerpersistencetrojan

  • Family: MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: Clear Persistence

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2