Extracted

Extracted

• • Target
    1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
  • Size 92KB
  • SHA256 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
  • MD5 786ce74458720ec55b824586d2e5666d
  • SHA1 6f62e7fe75a0876939e0dd95d314b83e25e1e395
  • SHA512 083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
  • SSDEEP 1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
  • TLSH
    T146938C28D521D136F8A310FF8BFA96BDAD644B201303D4DB97C01E49AB855E5F932A37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutioncrytoxdharmaimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Crytox

    Crytox is a ransomware that has been active since 2020.

    ransomwarecrytox

  • Family: Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (752) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2