f4af911a2955974ff30e96e3883c2569e6547031972ada106ee9142b85dac4f4

General

Target
rw.exe
Size 15.7MB
Sample260723-s4hsmasbnh
SHA256 f4af911a2955974ff30e96e3883c2569e6547031972ada106ee9142b85dac4f4
MD5 9c12147b6acb8d90a24c5769ce119267
SHA1 55a766a03cb1b2425a45f3bbfa7371314e1b1840
SHA512 49b079827d2e36a667d0d634e9c2abbe537aa84534b32c56d3102968af0ea8945160151a4c76a328adbb00fdf1a5fb319a4621cc8a19e70f3a0448e037efec06
SSDEEP 393216:fGV2FW80m1+TtIigSUau504NsIjoymdfclfMewZzW71Ew2:CSW80m1QtISa50DIjoysfclUek
TLSH
T1E3F63340F2D609E8D587E63996E44A2727E238A653F0C1CF57F819614E33AC5FEB9360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  rw.exe
- Size 15.7MB
- SHA256 f4af911a2955974ff30e96e3883c2569e6547031972ada106ee9142b85dac4f4
- MD5 9c12147b6acb8d90a24c5769ce119267
- SHA1 55a766a03cb1b2425a45f3bbfa7371314e1b1840
- SHA512 49b079827d2e36a667d0d634e9c2abbe537aa84534b32c56d3102968af0ea8945160151a4c76a328adbb00fdf1a5fb319a4621cc8a19e70f3a0448e037efec06
- SSDEEP 393216:fGV2FW80m1+TtIigSUau504NsIjoymdfclfMewZzW71Ew2:CSW80m1QtISa50DIjoysfclUek
- TLSH
  T1E3F63340F2D609E8D587E63996E44A2727E238A653F0C1CF57F819614E33AC5FEB9360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution persistence pyinstaller ransomware spyware stealer
- Renames multiple (4132) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates processes with tasklist
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1