86a06d01be8fa7ac231385db134254718fcd39d410eb0a2f106a9636af95b62c

General

Target
wolkafashion.pl_sn.exe
Size 28KB
Sample260905-mwkpcszsh1
SHA256 86a06d01be8fa7ac231385db134254718fcd39d410eb0a2f106a9636af95b62c
MD5 b812a15f58df6cc515dec4ec3e1514b4
SHA1 c090c7564643c152edf913bfd08a557bb8138c6c
SHA512 3801863ffe263649fe9d1db07cf5f31871c80a97898f4c56d26437c04b955917f250dc16f676bab7662ee80849a8968738f397193379556e0bf15159f853b65e
SSDEEP 384:ZsT4BnlGXsDqNUyIE8JIyXQ7f65i38PaE29nm9dr0jYoBxKiFd1/36qh2jzCp/wR:KT4Blj7pJQeUE29e0jL1DhyzCpo0Q
TLSH
T1C6D2B408B7F84619F5FF4B7A9F7202008A35B8276D72C75D0AD2548E1D72B418DE2BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  wolkafashion.pl_sn.exe
- Size 28KB
- SHA256 86a06d01be8fa7ac231385db134254718fcd39d410eb0a2f106a9636af95b62c
- MD5 b812a15f58df6cc515dec4ec3e1514b4
- SHA1 c090c7564643c152edf913bfd08a557bb8138c6c
- SHA512 3801863ffe263649fe9d1db07cf5f31871c80a97898f4c56d26437c04b955917f250dc16f676bab7662ee80849a8968738f397193379556e0bf15159f853b65e
- SSDEEP 384:ZsT4BnlGXsDqNUyIE8JIyXQ7f65i38PaE29nm9dr0jYoBxKiFd1/36qh2jzCp/wR:KT4Blj7pJQeUE29e0jL1DhyzCpo0Q
- TLSH
  T1C6D2B408B7F84619F5FF4B7A9F7202008A35B8276D72C75D0AD2548E1D72B418DE2BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation ransomware trojan adware spyware
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables service(s)
  defense_evasion execution
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2