Extracted

• • Target
    GMCRY.exe
  • Size 64KB
  • SHA256 a7bbd5ad19a8a722a57c921dcd61de8e639e2cbc03d97134e17f4c796badcab0
  • MD5 89aa72a7830d02cfe3da2488bcfabf82
  • SHA1 685a5e9fd92207f538d63e93c5dff610f58d49c7
  • SHA512 857eabfe2ac7aa1b05354d65c574fcf6817160c4a09d805388bbe7b85b237155e722e6eaa4f688927a560f902d03d6810b0f0c0584223bfe9585687dc613155a
  • SSDEEP 1536:hvZgPPtzJ6qleE2nWsb/80RTvsozY3bliTjVv:hvWtF6qleESWsb/80vsTbliTjB
  • TLSH
    T1CC53F80577F88A05F1BE5B79CEB281404776B9929936D70E0DDA68CE0523F108DE2BB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Adds policy Run key to start application

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2