Extracted

Extracted

Extracted

Extracted

• • Target
    choco.exe
  • Size 187KB
  • SHA256 1e13981a6e4c72e3f6e8e0cb21c040a9e050d4d2a001c175b2893bc95ccfbdc2
  • MD5 488e4f768b46aef78d950fb3170ea698
  • SHA1 ee170e022a12eb12251480b2cdd7cf4f5f53ef9f
  • SHA512 36802a3286e28b86b425ff81fece12082cf8d23af8c601be09d2611f395d06286a26a050ee71ae42cbaf3bee18a6f98321720a4b327d337cbb9696da67197e9e
  • SSDEEP 3072:PMWAB/EtY+4X0ikeYxpIWmjupQNmWlT4so4RtwydQWeObG:q4hispTpQNmBskOb
  • TLSH
    T11B147D05B69650FAD267C678C9034942FA337C464B60ADEF13900BBA9E736D49F3EB11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojan

  • UAC bypass

    defense_evasiontrojan

  • Renames multiple (102) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2