Extracted

• • Target
    ransom.exe
  • Size 77KB
  • SHA256 7bee4350ef419c10f97b8c150c992cb5668605eb7692c07d191ef081ffd67422
  • MD5 d6a219124abf57bc151d3f5b272d53d4
  • SHA1 16e111c419522a33fdc3121fa354907babc7fdfd
  • SHA512 d75c23953f054b658c9cd26807958231db66e15d9edc3a4e145f18380ad54a065e3453f98bcb180c523bf14beb41d9647da18d05ef7ae1e14681833db2184066
  • SSDEEP 1536:eiZHWcDVI7LujGoBWrSIZjqdeaJLxSO47QoDA4FQzNT:1HWcDC7L89Wrvtq59xI7AVzNT
  • TLSH
    T19E730A2BAE15506ED269D8B8D9534902EF717C8A8791B7CF17901CF30E166D8AF3FA01
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojanadware

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (304) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2