Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1.exe
  • Size 66KB
  • SHA256 f3474589cafa855a73d0830883b9909095f82c28aa468e999940faf85beca4c1
  • MD5 62e9edb7e44dc3eecd59ad14f9324dff
  • SHA1 537f2f42c2aeef0134c2a32a84733796909f0f3e
  • SHA512 93ed22604d2fac6ffb2002617a04bb7793c78cbb96fa79aead8ac4cb22ffffe8bd2ae7c7c7c026780eb3c5185af7cc534a3ed3238c05c73c9d4b21003729bd0c
  • SSDEEP 1536:jzICS4AT6GxdEe+TOdincJXvKvWLBjklE:8R7auJXSOhCE
  • TLSH
    T1126339207181E0B3E465DBF3E70A75A2B349DE3A0D626817E9E80F086DF89536F15D4B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryblackmatterransomwarespywaretrojan

  • Family: BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter

  • Renames multiple (128) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2
• • Target
    f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f.exe
  • Size 718KB
  • SHA256 f725792a5ef0512f3c5356d79fb3be5afcbaffaa4af41498342f7d09d703761f
  • MD5 d7a24de75b761cb98f580dafda4ba885
  • SHA1 86dc51cfc817937f9525b8aa2fa71e918288a44d
  • SHA512 c3fd50a296b4d251a614816756eb17632779c0ef0e72826d9d276ccae8b1689ca0523a22027509ce20bf125f858f713b08967ae55501c457bc9d8fca956b0e9e
  • SSDEEP 12288:YuLRIEFPULfzlsH5HCSSv5zEWptZ/Vlt:YeRIEF6zlsu5AWptRVlt
  • TLSH
    T144F45B25F2C18175F0E24D3A2EA5D9B659ABBE301A32C14B32D8771F2B355919A33337
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

  • Deletes NTFS Change Journal

    The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.

    ransomware

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Clears Windows event logs

    defense_evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (3961) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables use of System Restore points

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3behavioral4
• • Target
    fa32b935c58778baaa011730087466c54d5b863060a9c3ae6b5146733d643256.exe
  • Size 69KB
  • SHA256 fa32b935c58778baaa011730087466c54d5b863060a9c3ae6b5146733d643256
  • MD5 905a609306ac1ee2f94b751bdce7187d
  • SHA1 780759cc52b16938734b433b942c6aecfac8eeff
  • SHA512 e6a68b593c6a19421b81744b637113c1d5c495db31940aab9524c51e58295c0357f996d96d2ae89b80cc1d5e749e5b05c0fc57c1812048f30927c8f9f2500ce8
  • SSDEEP 1536:zZZZZZZZZZZZZpXzzzzzzzzzzzzV9rXounV98hbHnAwfMqqU+2bbbAV2/S2Lkvd9:DBounVyFHpfMqqDL2/Lkvd
  • TLSH
    T1A1636A0EA2E1A193E1F357B9FA757E65446E3D203B289BDB099359852D630F0793B303
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  discoverypersistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    fa4ff1d4f304f9e6c9e55bafd47547139c87ff90f976fd9ba564904614b9f5d2.exe
  • Size 4.5MB
  • SHA256 fa4ff1d4f304f9e6c9e55bafd47547139c87ff90f976fd9ba564904614b9f5d2
  • MD5 a5569740083cb4fc3eb03037790862c4
  • SHA1 c70a761c900b16948fb4f8cc827ce1735eb5ec76
  • SHA512 bc87d46d2b7849e925a818576f383e18075fa6002bd7bef279f1ae23637e7712bb455f1747a28c38c3315d91308ff57d300d99d7cb7f289cb14519829a1a6ee5
  • SSDEEP 24576:aWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWpw97+Ysha8d9VwbIEvtpZfM/fSC7:tw9MauVwbIEvtpZfoZ
  • TLSH
    T1FD26E5FEC367ED2AF03E42705019021A3220E1A67963C32F374FB55DBC5EE146996AB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe
  • Size 225KB
  • SHA256 fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3
  • MD5 f62590e838b1d13960abb6b363e03ed9
  • SHA1 66f706a7d39038964471e0a009a76e0f978fb075
  • SHA512 7d372043b31cca8d6d73ecd386e08d720ec29fa02e6c01b099c70977e7bdbd06f2a2a8c44f1b813c1a4b67b12a37a51efcfc3776e8667ed216b25d2bf1d56556
  • SSDEEP 6144:IuC7JmXiQwAh6jkJwkNV50DEr9MxgTw7ozFD254W:IuCteiQwAjw1DDGcopfW
  • TLSH
    T1CC34BF10E6C290F2EC9B4FB995FA59FE50356E208335E3F7DBDA8EA585326C2C134251
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryevasionexecutionvenusimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Venus

    Venus is a ransomware first seen in 2022.

    ransomwarevenus

  • Venus Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (9751) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral10behavioral9
• • Target
    fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222.exe
  • Size 4.2MB
  • SHA256 fa699170fb2b3c5589bc8c07d6df583bfeb378ba8f1c418d469b857b1f50b222
  • MD5 94a84e0cd8adda837ceb72d95b88344b
  • SHA1 29024ecf179764920b871d92bbfd77ff8d6236b1
  • SHA512 032e3be4cf940c5d4c6ba2470e13955872d87a9279faa5b8fb8e75fc2672af1a62614915c88c90d2e165ab49630934827d796006e8941c0c79436357a0d6a6fb
  • SSDEEP 49152:5jLuSh3i+FtvkMzT+TIRLhd4HOV5ZNt88QulV03OX:RLu1TIRtUOV5Zv
  • TLSH
    T114265B1577D48126E0BF4739587393842372F8939D23876F31A0A76E7D727808DA2B7A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionnominatuscryptopersistenceprivilege_escalationransomwarespywarestealer

  • Detects NominatusCrypto C# variant

  • Detects NominatusCrypto DOS executable variant

  • Family: NominatusCrypto,NominatusStorm

    NominatusCrypto aka NominatusStorm is a ransomware written in C#.

    ransomwarenominatuscrypto

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral11behavioral12
• • Target
    fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063.exe
  • Size 225KB
  • SHA256 fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063
  • MD5 1c45c33e9884cb10264c1a2a0255e72a
  • SHA1 1992336a5d752187c979e24a95a871d8932ade6d
  • SHA512 ef8613f273ae04ae61c477ccaf81799f91d38b5f6453ebbdc39c05745cbab927849321f90547982016eefa43574efa1bedc5f90e9c7a5e38b70bc79e442ed9ad
  • SSDEEP 6144:AeJmXCQwAhozkJQkRV50DErCMxgTw7ozFD254W:AQeCQwARQBD+GcopfW
  • TLSH
    T1A434CF10E6C290F2DC9B4FB995FA59FE50356E208735E3F7EBCA8EA585326C2C134251
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionvenusimpactpersistenceprivilege_escalationransomwarespywarestealer

  • Family: Venus

    Venus is a ransomware first seen in 2022.

    ransomwarevenus

  • Venus Ransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (8449) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral13behavioral14
• • Target
    faf4beb7a2b772c2e27568b9875b19059e55b17d6cdcb4d1c62973a89a071578.exe
  • Size 3.2MB
  • SHA256 faf4beb7a2b772c2e27568b9875b19059e55b17d6cdcb4d1c62973a89a071578
  • MD5 384f4cca34e9bd3174c7959b142b5d7b
  • SHA1 5ac0b2609e3971c20a37ec3c790eca526036843f
  • SHA512 1a78f542325c597d7ad6b67573d11aabb207f491c69947b5a100ebab0bbe7819dfb1636723ecaf6c311862dd247f783567babf440d4f574185ab0c6645d8a229
  • SSDEEP 98304:9goS+ZFcEsZUONQnvO9IsDW2X41U58ci8FpnuzK:9hFJyU4IAWX5chLum
  • TLSH
    T1D8F533DD318271EAFC6E4C3D461E044FF941A069E5A06C53F59BCA73EC34A6822B4E6D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  discoveryupx

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral15behavioral16
• • Target
    fb1fc5323853e3289c41b4df3851cda88462ce954c2b9c7102c5a363dfa8166d.exe
  • Size 666KB
  • SHA256 fb1fc5323853e3289c41b4df3851cda88462ce954c2b9c7102c5a363dfa8166d
  • MD5 7212675ad49b5134c6dc7509669b1526
  • SHA1 4a664c194075afc720ec7ec04b9393054782bd11
  • SHA512 a80e57d74149e2c268ef93532c3fc15b5516d02895dabf0ca6cc4230f6dd37aaa86d37130dc1a5899b1da22a6a45ded6026f45564963dd872b3953f7ffb211da
  • SSDEEP 12288:ZYW1LNT35lDbK/LIVaN8+T7vwqyqhYMhWt918vulA9C9+m:dd35lDbKDIwWUDyqS5omEC9+
  • TLSH
    T141E4AF1035C28033EAB301718EBD966D916DF9220B266DD7A3D8465E5FB99F27E31233
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverymedusalockerransomwarespywarestealertrojan

  • Family: MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker

  • MedusaLocker payload

  • UAC bypass

    defense_evasiontrojan

  • Renames multiple (215) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral17behavioral18
• • Target
    fb373f456b75905018034f493768a17f9458a8e5a433d04c925c4d137724f22c.exe
  • Size 131KB
  • SHA256 fb373f456b75905018034f493768a17f9458a8e5a433d04c925c4d137724f22c
  • MD5 155717a88626227ad8d01c821dbf71ab
  • SHA1 4622f32d8c97d5a457f4e9ad58aa153acd8cbfac
  • SHA512 18e86d78578370279ec8d55e4da898f9194169ac4095a739e60c6d39978a7d5815f6069f5e30b3b59cbaa63c4cae7257ec8b1240300669cabf30811c9cf9da3f
  • SSDEEP 3072:Mc7q9xwhoUhRPkkWfZf5wX/gowJOLEnlywUaBbeWWiUNm:Mz9xwhlkkS+Xoow0mlywJ4a
  • TLSH
    T1AFD3028268BDDA1EF201453693077F79539862540FD39EEF0CFBE2246045F6AAB2B614
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionsevenpersistenceransomwarespywaretrojanupx

  • Detects Seven ransomware

  • Family: Seven, SevenCrypt, 7ev3n

    Seven aka SevenCrypt or 7ev3n is a ransomware.

    ransomwareseven

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral19behavioral20
• • Target
    fb38ca9105614973ddaabc6ce76068be002a4b69a9f801e2cc5b962f84ffab7b.msi
  • Size 11.2MB
  • SHA256 fb38ca9105614973ddaabc6ce76068be002a4b69a9f801e2cc5b962f84ffab7b
  • MD5 2bdc70b62425196afbf7680e4c62b593
  • SHA1 543bf46a44afff36df779d8f8b90281d17f17b6c
  • SHA512 f73e76cc2aa3c8835d8468a6780bdaef0e93e5eedb80381767855fd2fe0db0137bbe7e330eb4b8f23d1ceb30848fea7b1e09765a8fb85c626b7288d78a6c12a2
  • SSDEEP 1536:9RGoXP8nA47+XGh/VYN5jOVRjtpNZBOHmdm/b1Ds0DU7T:ioOV7GKs5jOVIbk
  • TLSH
    T1B4C6C3D3E8B22DC3C96746BB834D0A900068ECE16146DF32273977683EFCA99D193597
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionevasionexecutionmagniberimpactpersistenceprivilege_escalationransomware

  • Detect magniber ransomware

  • Family: Magniber Ransomware

    Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.

    ransomwaremagniber

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (74) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes System State backups

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Uses Regsvr32 to proxy-execute a script

    Regsvr32 is a signed Windows utility used to register OLE controls. It can load scrobj.dll to execute malicious scripts from local or remote locations.

    defense_evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral21behavioral22
• • Target
    fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3.exe
  • Size 245KB
  • SHA256 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3
  • MD5 ea34ac6bf9e8a70bec84e37afeea458a
  • SHA1 fd443460ccd1110b0a77385f2f66a38d3f527966
  • SHA512 d3bb774467813d0f1e0a8e046dc14a4b372bdd61a6c5448c3b296e09f5f9f7493167b82aa7a6824979154f538ba05178af23247c55e7688fa78414168c13dbfa
  • SSDEEP 3072:ZO459Ejzjz10wKaEcKBIacm6QBDOmkm9wXcIfGBF5UgbB67Z:T8HzKxhcKB0VQBLk7XcIkbkt
  • TLSH
    T1DD341800F54ECBE9DA9343BC4956A602FEFB328067148AE7D7885A310D075C579BDFA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discoveryexecutionransomware
  behavioral23behavioral24
• • Target
    fb69b4b5637a6b7aa40ba7ae56ed617d375f67984c3028a7607e1764fdda8490.exe
  • Size 1.8MB
  • SHA256 fb69b4b5637a6b7aa40ba7ae56ed617d375f67984c3028a7607e1764fdda8490
  • MD5 5fdd033b614e18f7ebbfca2e7d6a1996
  • SHA1 fa047c9a9e8dc5fa2f92ad34e02e309edfcd0b61
  • SHA512 4935e26c697b057630dc36dd65f6999741a357cb73cd7bb8d3fd376f1bc11bf57b8a100089dfc9cf24a7c33995a24d96e0759f2994c6f1a30984ab0db0de5b53
  • SSDEEP 49152:3Dmghls3y1+XfWL6Vcp5/e2JtJA6O33q74dXV:Tmghls5Bq/nnA3q74d
  • TLSH
    T1439533728AA79057D401353E7BA89054D083921DE5B2959F12ABC44F007BBAFBF8DBC7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistenceupx

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral25behavioral26
• • Target
    fb906531e1ea9546e4df878394a50b9e679201c23a7ac59f69f5de2e6c0963a9.dll
  • Size 5.0MB
  • SHA256 fb906531e1ea9546e4df878394a50b9e679201c23a7ac59f69f5de2e6c0963a9
  • MD5 1e4a4f54b53b3f7dc1910eab98c1ddb5
  • SHA1 d48ba36a7699596d169cab53165d0d69c3f3ab4f
  • SHA512 804bea7c06739406c349ad66fbae311543e407a0992adb9d24dbbce6b28a91bb014903ae3807f1167858123fcfd232dc7c64387b807c384d42b803d97b21d359
  • SSDEEP 49152:RnGMSPbcBVL1INRx+TSqTdX1HkQo6SAARdhnv:1GPoB91aRxcSUDk36SAEdhv
  • TLSH
    T1FD3623A6717C90F8D205197084AB8A12F6B67C3E16FA2D0FDF408D792DA3F56B650B43
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverywannacryransomwareworm

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Contacts a large (3349) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery
  behavioral27behavioral28
• • Target
    fbdb067707c1c1338e177f6e0a0aa27b926079d709e84b1881362f5521a46b9d.exe
  • Size 825KB
  • SHA256 fbdb067707c1c1338e177f6e0a0aa27b926079d709e84b1881362f5521a46b9d
  • MD5 f55db99067f260e2ee807c0564e6e572
  • SHA1 72bd3eb6861a1d014a021da16d6f695c5478601c
  • SHA512 dfff51500d258d8cab07c161ac65e390009f96d812f78387fbf3cca7a1ea8ce570f003fa40884fa6722d2539f9173f9aa91f8caa6fbd6957999c2e38ac4da278
  • SSDEEP 24576:Q4I2XHg1CT29GXQFXYE5ErcAPAVvKYhj:Q4I2XTtAWmErcRv
  • TLSH
    T14705F200BB60C435F5B712F84A76926CB92E7AA0A76451CF63D55AFE9B34AD0EC31307
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydjvupersistenceransomware

  • Detected Djvu ransomware

  • Family: Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral29behavioral30
• • Target
    fbe45ed19fa942cc5e767acc0ef638447c4aa4b52d4900627a0a0ae71d543bee.exe
  • Size 210KB
  • SHA256 fbe45ed19fa942cc5e767acc0ef638447c4aa4b52d4900627a0a0ae71d543bee
  • MD5 845687a6196ccee51b99b04de02ade33
  • SHA1 772dd1e895e8311a6b1e9134fac0848e54712729
  • SHA512 e947677aac96ad968b3510684a3a45bf192873ca84b9db4251ea93a1653dc1f16f65b667b7160ed3426b6288a44b7c75e2b3e25e00fc9b3e1c0d414d4b3faa15
  • SSDEEP 3072:S/Kin29bECksoKpNsy1DPUUacHx2/yKnF5IIGSqo:bu2NHvNnsUamx2PLvqo
  • TLSH
    T1AF245B20F289856AD5A54D3225F83FF290B899783B0F8DE7B3EE4A3D15709E11120F5B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  credential_accessdiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Renames multiple (9075) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  behavioral31behavioral32