58c9f02d4bd8413f6819b9ba40121245e0ff4c771833d2e76e9838e0b22851fe

General

Target
Beef.exe
Size 70KB
Sample260729-dr5z3atbnd
SHA256 58c9f02d4bd8413f6819b9ba40121245e0ff4c771833d2e76e9838e0b22851fe
MD5 a7c3877f41f6273d28749d500f629d54
SHA1 02543a3bfc3bc75e43e171a1a125a578fa92025d
SHA512 d9b05ba5901248d1350b3378682d4106eff2b897fbeb5954f9923f2ac1618c6a150b07285df368e8217fffdadc7b9ddca722410f3cb7524bf4bbea55598ce5bf
SSDEEP 1536:NrlnJVfjAMrwIK6klYjak7uy4Romu/nMVh6ZEHXJuj3z2n5:llnffjVrwUak7uy45RVhSoGCn5
TLSH
T17E63AE1573E0C4B7E5721B309E7A57B76AF6E92001A4970B1710BF2EBC32141DE1EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Beef.exe
- Size 70KB
- SHA256 58c9f02d4bd8413f6819b9ba40121245e0ff4c771833d2e76e9838e0b22851fe
- MD5 a7c3877f41f6273d28749d500f629d54
- SHA1 02543a3bfc3bc75e43e171a1a125a578fa92025d
- SHA512 d9b05ba5901248d1350b3378682d4106eff2b897fbeb5954f9923f2ac1618c6a150b07285df368e8217fffdadc7b9ddca722410f3cb7524bf4bbea55598ce5bf
- SSDEEP 1536:NrlnJVfjAMrwIK6klYjak7uy4Romu/nMVh6ZEHXJuj3z2n5:llnffjVrwUak7uy45RVhSoGCn5
- TLSH
  T17E63AE1573E0C4B7E5721B309E7A57B76AF6E92001A4970B1710BF2EBC32141DE1EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit impact persistence privilege_escalation ransomware trojan
- UAC bypass
  defense_evasion trojan
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1