Extracted

• • Target
    Launcher.exe
  • Size 1.1MB
  • SHA256 92871c72c5ffe83d48df3b3333b7c31b7aa0b4e1a617f6223367ba7078f70a50
  • MD5 88abc4685e9d179bb9d461042cc4583e
  • SHA1 6a59721b84406648edfaec302c148db608c632e1
  • SHA512 c09c1fc4fe1dd913d0777e134a6516c9bcbfe4327f058509be354357c5f0dfc3af79bbc1283e980bca94e38a6f24246f3131b6b466b4afb1896267c4a2057bfa
  • SSDEEP 12288:VZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGiOvPqItNquB:Vcb4M06WpoPrwevP3f5
  • TLSH
    T168357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionwannacryimpactpersistenceprivilege_escalationransomwarespywaretrojanupxwormxmrigminerstealer

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (100) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2