Extracted

• • Target
    xyfer..dll
  • Size 605KB
  • SHA256 34e932f5cb2a8289ad417fe21daa2e83880b892203b014c31983c36d17217113
  • MD5 200d487bad71573d9ceb2e7453354367
  • SHA1 69fd4bb1d869a89669baafee34c56a7873362a18
  • SHA512 3664ee9014986a7895b1e69ba9cf9e29ba7649c55dc4483259e7f5aa3be43eb6ba99d58080d4c516e37941ecb6196957fdafc1029778abc5b464d70b1f52f783
  • SSDEEP 12288:HnxoiVlWDGg1aiqIhXjQccjFSgnhZRFW5QgKbVVrWHJD9HKoZlzVCKppi:GiVlWD/ciphQccRlRFWeobqAlpCr
  • TLSH
    T1C1D4DF6023E94D51F5BF1FBA94B11200DB31B902CD72E3DD5EE5A0ED0E63A84DB097A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojanadware

  • Renames multiple (6111) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2