e9e53aa63e78c39f4cb77294eb26e6d44f7dbff2493a0be930eb4d0f04cd1576

General

Target
plikan.exe
Size 87KB
Sample260808-3plk3sfg98
SHA256 e9e53aa63e78c39f4cb77294eb26e6d44f7dbff2493a0be930eb4d0f04cd1576
MD5 c11042c85648dfed87eb74982e71164d
SHA1 927e2373a3582e874b95a503ded6f77e02c0c053
SHA512 7b241a370d0364b2d5a79edcec11ffe1a125ccb58e4785535db0cc8ef5c8286b538fad44aac17f5905c9ddddff7a5a2c67cdab7069c9784bf34abcbbc4d51cff
SSDEEP 1536:Drjjxu3AUXzyRbTp43PEuWKOib8155bchA4hR0ZAaXRj/N2tWyiqdc7:DLDUmRbt4/ExKOuU55bchXf0ZAaBrNqy
TLSH
T1DC93064073F84927F2FE6EF6197262400776FEA69D12E38D0DD610DE04A1B94DA60BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  plikan.exe
- Size 87KB
- SHA256 e9e53aa63e78c39f4cb77294eb26e6d44f7dbff2493a0be930eb4d0f04cd1576
- MD5 c11042c85648dfed87eb74982e71164d
- SHA1 927e2373a3582e874b95a503ded6f77e02c0c053
- SHA512 7b241a370d0364b2d5a79edcec11ffe1a125ccb58e4785535db0cc8ef5c8286b538fad44aac17f5905c9ddddff7a5a2c67cdab7069c9784bf34abcbbc4d51cff
- SSDEEP 1536:Drjjxu3AUXzyRbTp43PEuWKOib8155bchA4hR0ZAaXRj/N2tWyiqdc7:DLDUmRbt4/ExKOuU55bchXf0ZAaBrNqy
- TLSH
  T1DC93064073F84927F2FE6EF6197262400776FEA69D12E38D0DD610DE04A1B94DA60BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence ransomware spyware stealer
- Modifies WinLogon for persistence
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Sets file to hidden
  Modifies file attributes to stop it showing in Explorer etc.
  defense_evasion
- Creates new service(s)
  persistence execution
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
behavioral1