Extracted

• • Target
    1705198765139_fttgrop091727639.exe
  • Size 5.4MB
  • SHA256 d491cba96d705dc81d5fdf190d83c1b7409337e12c81a611339b5a0276b14528
  • MD5 375458b10e0675af170867c24f8919a6
  • SHA1 ce09a075c397ab3c0a3f77edf193067912c98c98
  • SHA512 e0266e8f82eeae0c9d2bffd9b17c1f3977c7557b16f5a86a69757863faa1798a80045a76efb224bf03a0cd34c6631751da04d844d71fc5653743007333ae0435
  • SSDEEP 98304:ltfdKXgOYVH8h0VHoz7NnXettSBlQL7A6C4T2tkrgnZyjJevostUe6x0X6:LE3zh0VK7levLL7nCQ2tCKue6x0X6
  • TLSH
    T192463313A3CAA831F12F9536E7D056DC3DDC7E8400BB67A63DA1F248CB9344199A7B61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Suspicious clipboard content.

    A suspicious script was copied to clipboard.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Downloads MZ/PE file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1