Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    0084af770e99180fcdc6778c513d36384cf4b3ff24d0f8bc62ecaa76651be616.exe
  • Size 363KB
  • SHA256 0084af770e99180fcdc6778c513d36384cf4b3ff24d0f8bc62ecaa76651be616
  • MD5 98dd954197c153c444af80988667c206
  • SHA1 f7b5b3b6814dd97de04d76adf62b57525284bffc
  • SHA512 2be691616575ec1e3050e8843a5b0f02cb978b03aea885a67e885595e952cf4e856eb55af90469fe5718708cb4efafa366139a0b574fbc8d0e593fa99bac8c64
  • SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371ow:/uTs1gBpQL5kmh0671ow
  • TLSH
    T1FA840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsevenpersistenceransomwarespywaretrojan

  • Detects Seven ransomware

  • Family: Seven, SevenCrypt, 7ev3n

    Seven aka SevenCrypt or 7ev3n is a ransomware.

    ransomwareseven

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    085a2a09cfdab9a65f50fa2ad4bdd21645463bd36e8a01b9b5a4accabc1c5055.exe
  • Size 27KB
  • SHA256 085a2a09cfdab9a65f50fa2ad4bdd21645463bd36e8a01b9b5a4accabc1c5055
  • MD5 923a49da85fcb422b7e7d1a40b480964
  • SHA1 bce753541fdf17a84ab627fa612210ccf9ba91c7
  • SHA512 c59300f8c3c81e3bcfedbee0fe309cb907e73612b879879830a8dc0baabb0e74dcc7446c63cbff4371d58abb21be07e31f28538f77c97603218ac392acb9231e
  • SSDEEP 384:VtWZPzzxAm1vvlzey3EWx0OeuBbsXlCOy5o91atuU82vYs:c7zxAm3zb370Oeu1Rho9Ed82gs
  • TLSH
    T16FC2B30477FA463AF6FF5F7869B251014B76B956DC29E74E088E11890C32B8CCDA0B67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionchaosimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Chaos Ransomware

  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (328) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral3behavioral4
• • Target
    114e3769d9cff47038ef22c3827dc28c5be3ca6b1aeeb2589ce87727bdd4b5bd.exe
  • Size 285KB
  • SHA256 114e3769d9cff47038ef22c3827dc28c5be3ca6b1aeeb2589ce87727bdd4b5bd
  • MD5 cc745e4afff90df0bd50cb08e63fa7f1
  • SHA1 43dac496fae723dde8d99263b83385aaf3017c5a
  • SHA512 b9aefe2c6efbc2b9cbc5153b8f856590654d8ad426d7d6c06baa8c939c6a39651819db1a600593e2c3cc50b92efebbece74ad93f25c2232fad2ac6531181b427
  • SSDEEP 6144:pRr9DZl3bMMcccecxbtccI877N399WoUIGpX4/xzLnJeSiIP9:PlrSx99HE9Ctuw9
  • TLSH
    T1ED548D4535A9C696C86A2CF1CC77C0F027777E6ACE055E03B4D9BF0D3A326A5B81215B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionchaosimpactpersistenceprivilege_escalationransomware

  • Chaos Ransomware

  • Family: Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (105) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  behavioral5behavioral6
• • Target
    74abc075fc1d5c8985c952afc25a48ba874e76f96af4dc33414e84db9e10b9ee.exe
  • Size 3.0MB
  • SHA256 74abc075fc1d5c8985c952afc25a48ba874e76f96af4dc33414e84db9e10b9ee
  • MD5 e6a9739d176792b04bb91eaf4eaa25f1
  • SHA1 efe6a45b379257eec69d0ed245e65a9e212f4b03
  • SHA512 bbbdfd5b888c1fb31b6977e696c9ecf2e5e929b7d63946e15ebeec59a59e5521f61d35fec1a36692ab5b8f5c92336a18deb371d9bdb0926a9fa2062e61a705e1
  • SSDEEP 49152:/0bOazO5FMB+s2UlwEhS4OhcO1iL3DOvyPZNiKYWmKxJ+HRiJT:/0qaSaB3KD5hcOGsybYyn
  • TLSH
    T108E5AE86FA8756ADCDA71870305EB33BEF306829001D8E63D7D55D60F93E7215E88A1E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryblackcatransomware

  • Family: BlackCat

    A Rust-based ransomware sold as RaaS first seen in late 2021.

    ransomwareblackcat
  behavioral7behavioral8
• • Target
    74d07337cec35ca672823d303dd95e0a87ee57532af56652c0e125fba29b4832.exe
  • Size 67KB
  • SHA256 74d07337cec35ca672823d303dd95e0a87ee57532af56652c0e125fba29b4832
  • MD5 eb8cffd6160a1a5152ab7be7ffeedf2e
  • SHA1 f30aae38e3e83250a87df72ca5c1ad390cf29bd5
  • SHA512 109091c15df5ca64a4e92a75f5a883fa9c414f85754219931d08aeaa213661902dd88b169b0430ca134a2174f73051f8a3edbbd73c38905643c181ddc87a943b
  • SSDEEP 1536:q5J6iSz7Z5CylqKNxIFibOw7JKQpwVcl:ygiS/XCtKNxIFibOw7JdpqY
  • TLSH
    T1DE63419D725072EFC867D472DEA82C68EA6134BB831F5213A42715EDAE4C897CF144F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverypersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10behavioral9
• • Target
    76c012f134e81138fb37ac3638488f309662efcc9bb4011ff8e54869f26bb119.jse
  • Size 161KB
  • SHA256 76c012f134e81138fb37ac3638488f309662efcc9bb4011ff8e54869f26bb119
  • MD5 ed5481f4b64e048f09d5d9d880dafa23
  • SHA1 9948c71e77c9a7551f9f3b976da5b0e5e5950afe
  • SHA512 addd60848f245d83c70a65414b3d676e92ffdb2f31aa2de3497b8cda69ddb3938874aac062005c66d81af2451c545a5c871db4a392815cd9e69707b0388cbea0
  • SSDEEP 3072:5tCIP3D125lF+90AGp9K9zCdKuxkvhq8n8skOfx/bll25DftO5:PPz1GlF+9yjK9WBxkpq8n8mItO5
  • TLSH
    T168F3086761C8D06A9770D2E10EC0EE25C5CFE1A083B281CE356DD6151E61D9E2F4BFAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionmagniberpersistenceprivilege_escalationransomware

  • Detect magniber ransomware

  • Family: Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (81) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes System State backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12
• • Target
    77ad72f43a71412976a9ccaa8517644ebe7ff3703e5274e965ca7de612a845e7.exe
  • Size 3.2MB
  • SHA256 77ad72f43a71412976a9ccaa8517644ebe7ff3703e5274e965ca7de612a845e7
  • MD5 76c9ff4d3f961df52c924568ed35a898
  • SHA1 919cdafd1e7f5b4de76e99204e7c8a6de73f783b
  • SHA512 218c85501965cfb7f87f4265b233116195261deb8f32c12389f43b6fcee40ea56bd0c8b41b2ad7c1dd94d3602a5d6636df99a95a270e2476600bc6a816149b33
  • SSDEEP 49152:hPLkK6gl91PXkc1Iz7zieL9xYWMvg0gAFkSQUok/N4lAGx7FrnhVz3/i8HIbUVq:SKQc1Iu+YWMvngakbUdKRRh5PCbSq
  • TLSH
    T18DF533D935D004EEEBBD46BF12545B34E9F0A63A39ACD7F59B308C9265232C4201BB5E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoveryspywarestealerupx

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral13behavioral14
• • Target
    78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14.exe
  • Size 182KB
  • SHA256 78cfc564141e12da9a1fe79a7703efa9edd2148f08be47b8077f6dc383a8ce14
  • MD5 9a5211f6e491d812d15363168783906c
  • SHA1 0d06ee595404de3264da3c71f489392b64fa1e2e
  • SHA512 f719f053a99c7d196e92b9743aabeee7cbdfdfb9a7a4378ddcbba27dcd7b7b6c2947bb73970f63a9fe789348f974c681a1ab9c944fa21e1a7c38a06b7b7fe237
  • SSDEEP 3072:tuTO4rRZi3mvXemGXcXscjGU39Aq+ZDPUEMTlqqYhCg9QD+IZ:tkZ0mvumGX4ws9EZDPFMT2baZ
  • TLSH
    T1A304BF07B3F4009CD176D1B6D9F5831A8BB1BC154B7193DF26A9869A6F23BE48D38312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryazovpersistenceprivilege_escalationransomwarespywarestealerwiper

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

    ransomwarewiperazov

  • Renames multiple (13411) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral15behavioral16
• • Target
    78f4dd4b0e0bff6009f56a8b97332f600cec39e3c1d0e1cac6c7ee47a4bb9201.exe
  • Size 6.1MB
  • SHA256 78f4dd4b0e0bff6009f56a8b97332f600cec39e3c1d0e1cac6c7ee47a4bb9201
  • MD5 04df8dd30da8b5853f48cc1ac9b695a8
  • SHA1 4c02262c2fea0e99277a99dcbe28a9c370b87c39
  • SHA512 3ad10c1512e316ff9d02bd5b4573298ae2f6fc8f9d56c66e2c5c4d95fe046e5b14b09e63cea9bca778560ce4b568ebdf70d66a0225b2eaf7e6cd3ba914583b7e
  • SSDEEP 3072:jnsbblTAByHNgb0nbYlwKsw962CpJid72gqV/6c4LNobbamucc3OD4iEDzyEaE0u:jnsq7hQplBdJ7bP4L8rVE
  • TLSH
    T140560D6F59E5E9D9C6E87872BF956E303720F7F00F5484872AE1A6A96F7F5270603800
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitpersistenceransomwarespywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Renames multiple (655) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral17behavioral18
• • Target
    79ee8d39960b8bef040fa2311f0f57b33040c429c4b79ae643df07cd44726e1a.exe
  • Size 1.3MB
  • SHA256 79ee8d39960b8bef040fa2311f0f57b33040c429c4b79ae643df07cd44726e1a
  • MD5 3ba978766aa2548c763e33efb77ce263
  • SHA1 41859b97093ab52d264233c0f01e857054b0aea5
  • SHA512 e2e6165bfdf5b41b2cda83e36edb19874c7bbcca98821796d44c72d2d426bb9e57d39e9fd13b14817c01f2d907ae9f9840cb9112addd6ab5aac5416d18ac19f0
  • SSDEEP 24576:i9BrMRmJkcoQricOIQxiZY1iaDkfGrMZbMwx3YVbedXwhPbnzdcMpd:itJZoQrbTFZY1iaDkfGrMNYBedcTzd5
  • TLSH
    T15255E122F5C58076C2B326B09D7FF769963D79360336D29B37C82D212EA05816B39763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionjokerransompersistenceransomware

  • Detects JokerRansom ransomware

  • Family: JokerRansom

    JokerRansom is a Windows ransomware written in C#.

    ransomwarejokerransom

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables cmd.exe use via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral19behavioral20
• • Target
    80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe
  • Size 162KB
  • SHA256 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
  • MD5 38745539b71cf201bb502437f891d799
  • SHA1 f2a72bee623659d3ba16b365024020868246d901
  • SHA512 772e76757069c3375cf1ffd659ff03f47f2d4becae61a852adbc27ae467551210d8832994f944c05fccc8486a8a88322021c94217a8bd962c2459af41067132b
  • SSDEEP 3072:MC/pu0EzJTnvxkIKztqGJ0OtiZ4/7I5jfa2F63Jvb3iN0RD3xpjb68Tzd4Tpx8W7:MC/pu1iIKztqGuU/7Ity2F65vb3FRlpW
  • TLSH
    T103F3125005673DCAD24823B2DECB93BD804A9139069AB1648FE13B38DFE14BDBC45B5B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverylockbitransomware

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  behavioral21behavioral22
• • Target
    81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41.exe
  • Size 210KB
  • SHA256 81ef74c7f2fc60eec99c3cef279ee47fe2e0accd0d964e4611616f1c64321f41
  • MD5 0a8a8d7d504c21ca27d8bca620a46595
  • SHA1 23787a4bc091c821543a54b86d91d24dee9455bd
  • SHA512 cf3be5331092e85934184549f778f5b6243e5e600c9359f8f06504ee44ac331018f7b73a940ee990196f72c40deda8db0155fa3aa82abbad9b5d64b958c370d6
  • SSDEEP 6144:rXs93PTbfYUmF3V62aOpBZw9M9ZTcCFLuU:rXs9fqTwQTVh
  • TLSH
    T18124261362A460E7C063B674B85FDB6F97617C6F07647B3E035C3F4A9E622809D29631
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryazovpersistenceprivilege_escalationransomwarespywarestealerwiper

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

    ransomwarewiperazov

  • Renames multiple (10158) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral23behavioral24
• • Target
    82f785167a5610a31f90d194cf71ff04ec6911ff1b8878f8defddfaa3180b555.exe
  • Size 8.3MB
  • SHA256 82f785167a5610a31f90d194cf71ff04ec6911ff1b8878f8defddfaa3180b555
  • MD5 a26018cd2c37af036be7813691de7b0c
  • SHA1 9a45302f1c3bdebf51ee43cfa4cb6ae04fcf39f4
  • SHA512 02e8c86a64ac2653c04293b80eb036347ff553affe0e717a9b7f4b77c456d72ffc872611ca7f4656b57df2a8bcad37caeb47d3007fd37680ea19c6aae4c9eeef
  • SSDEEP 98304:NLu1TIRlClurxUTkCOS20BYql7x+oZHcV4i/kgE7/FG4l7zP3u+0xZHcV4i/kgEH:NTRscqG0vGfLgc
  • TLSH
    T10696BED07BD6C268D85FC330046B46CE2270BF616E25837BA45433AE2D75FA8847D7A9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnominatuscryptopersistenceprivilege_escalationransomwarespywarestealer

  • Detects NominatusCrypto C# variant

  • Detects NominatusCrypto DOS executable variant

  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral25behavioral26
• • Target
    83fe1c4a70de34edbc70f7a3e2c920c222fdf495ef09cfb75d028f0cfec5f986.exe
  • Size 202KB
  • SHA256 83fe1c4a70de34edbc70f7a3e2c920c222fdf495ef09cfb75d028f0cfec5f986
  • MD5 fc884b98003773db773adbc150b7c435
  • SHA1 22ebfcef8e78db3a3e56141375afd61308b55091
  • SHA512 4217bc848c724e75059bef6bb33a64432ee26191a026a7d187415b0ce3f45b55fd6f50cff7d9b106bbea904ec53d83f7164bbc1c48c4dbaeb71d9d91c86e1d54
  • SSDEEP 6144:QLV6Bta6dtJmakIM5nI3FX7CYRoKz9MbAi:QLV6Btpmk6IVX2oHi
  • TLSH
    T1E614CF2677A94A2FE2DE86B9611212025379C2E3D8C3F3EE18D460F79F267E546071D3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverynanocorekeyloggerpersistencespywarestealertrojan

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral27behavioral28
• • Target
    84ad231f0d74cd4bed8da0fbfc6801fc77424ee74a560e0d3175aa37b4ecab23.exe
  • Size 55KB
  • SHA256 84ad231f0d74cd4bed8da0fbfc6801fc77424ee74a560e0d3175aa37b4ecab23
  • MD5 578244d3c1afbe8009f04bbc9eb54076
  • SHA1 83c1841f67d81d90aec1217766721bbb6856973e
  • SHA512 0a2b657dfb30ad60fca8c94fac6182b1273404a3163bd65328588e43d6440c3da7c9bd1fc9b1e5f75496f58304051108763e3fb30dddca8b589ef8fcdbb54481
  • SSDEEP 1536:ENeRBl5PT/rx1mzwRMSTdLpJtsbChoirP:EQRrmzwR5JqcZ
  • TLSH
    T10F43BF46746D40B2CE718AB0293A7F5B4FBEA10540B4949B4F390D963ED5132D72A3BB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryevasionexecutionphobosimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (834) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral29behavioral30
• • Target
    84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb.exe
  • Size 441KB
  • SHA256 84c06f4b2fd1ebc6a931f112520fb13300f3b36c45cacb956f6045e6f388e5fb
  • MD5 90f9a62dc1145821e357c795501ab1b3
  • SHA1 4430b9ff2ffacceb182e2cacdea530abd0174166
  • SHA512 ed2943c5ad9152b810ee3fd2abae0aface3aba11257f1b1f88093e59d475ddd10733b20b547e879dadd288d7298424e6f8383bda2eef471701fad3b9ed4af37a
  • SSDEEP 6144:4b9KHnmm7C7MBeqLonYhFL9lx6k5dQFY6LxyGeYCl9:NfC11YT979j6Lxyj
  • TLSH
    T17CA4CE7A7604DD07CD211CB49053DAB4DA716F92DAC8AD163AF45FEF7E38A42990C30A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionpersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral31behavioral32