71f247388db09dbb3c2005c31f0b39c23e1bf7891c72cbaef61ba67cf0dd88fb

General

Target
DFJfSig - Imgur.png
Size 8KB
Sample260816-ym4xeshn4s
SHA256 71f247388db09dbb3c2005c31f0b39c23e1bf7891c72cbaef61ba67cf0dd88fb
MD5 bf1ad5539da6b4dc0dfd8f735dca2675
SHA1 c809e9c7db3a1a8f1ac1aee9a48427427440c08e
SHA512 79cea4f62131a2a561eb2e122e0370ca7de56b24ddc40d569e2c4016a06b8043a11cfad0be724558d2bb30e45a6848821e6d76d4bec2fa1e19359c4528f72de7
SSDEEP 192:DjERuJy5x1llHRfuIjU2yufuXxczLatgxMj0I56L+Uzc:DjEx5rl3fUhuf+KLZMYIM7c
TLSH
T11302AF1E0731A7FF608DD20E64CE64A86A16DB4043BD9B04BE4D630A9D81DD57F392AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  DFJfSig - Imgur.png
- Size 8KB
- SHA256 71f247388db09dbb3c2005c31f0b39c23e1bf7891c72cbaef61ba67cf0dd88fb
- MD5 bf1ad5539da6b4dc0dfd8f735dca2675
- SHA1 c809e9c7db3a1a8f1ac1aee9a48427427440c08e
- SHA512 79cea4f62131a2a561eb2e122e0370ca7de56b24ddc40d569e2c4016a06b8043a11cfad0be724558d2bb30e45a6848821e6d76d4bec2fa1e19359c4528f72de7
- SSDEEP 192:DjERuJy5x1llHRfuIjU2yufuXxczLatgxMj0I56L+Uzc:DjEx5rl3fUhuf+KLZMYIM7c
- TLSH
  T11302AF1E0731A7FF608DD20E64CE64A86A16DB4043BD9B04BE4D630A9D81DD57F392AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
- Renames multiple (6135) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Disables use of System Restore points
  defense_evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Suspicious clipboard content.
  A suspicious script was copied to clipboard.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Drops file in System32 directory
behavioral1