Extracted

Extracted

• • Target
    _e36ef17346e9d7ec9350a66a352cbdadb8e97e8e592ffbdb0e352fcba2f49f1d.lnk
  • Size 46KB
  • SHA256 e36ef17346e9d7ec9350a66a352cbdadb8e97e8e592ffbdb0e352fcba2f49f1d
  • MD5 9937605ed7b1019ad7786920d81d15ac
  • SHA1 fb77fdfe1c9e3ccf635718101a341cab97f88cce
  • SHA512 6b059c849d8f3500653f4ef25c8ed8d0aac48aaa5c34b36d3e1f70574db7610f7f02f6bcae5852b9e56a4ab7412f13d23afd76ed5f7e6f3cfb23048ead437ef6
  • SSDEEP 768:pckK8vwMw7RcJHVvfJfeCVTGyUu0smy7gNKsNC6rmPPkLn/LLd4fgWHmLxbA+3cZ:ehDMwdYF/oNbAGtFHK
  • TLSH
    T16623262929EA201DB1B3EF507EE438D9DDCFBA737925546B1085070B4B12E44EE9273E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executioncryptowallransomware

  • Family: CryptoWall

    Ransomware family which is an improved version of the older CryptoDefense.

    ransomwarecryptowall

  • Renames multiple (127) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2