c1e4a95441a6df2a72425a6bc1422f329760b0d55fdf85d7f55705e5ed873917

General

Target
RuntimeBroker.exe
Size 89.0MB
Sample261014-ch2evaet8w
SHA256 c1e4a95441a6df2a72425a6bc1422f329760b0d55fdf85d7f55705e5ed873917
MD5 8be25920ef13f58d1d176e74994810bc
SHA1 b0c3624b95ee46682987d3220c5bc4e25ade7a85
SHA512 dc658b2af6287616826612d04464e1187f6c0b61826c601c9f5836a95fd42f97fdea778ec184a704f83d1eb8215631bd6480f8f1e8344a66c7767c19b90443e4
SSDEEP 1572864:HYjYht9uhuZiPF+LnDQdvOhAy1wwPbLQECvVYmvnPKNbHlIrmIU:4jYht9guZoMLnEdvOhvVPnRmvPGbHh
TLSH
T199183381C8C35F9382A76C7D5D5B21022AE97B8DBDD1936F812D5D0662C3602A8B7F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  RuntimeBroker.exe
- Size 89.0MB
- SHA256 c1e4a95441a6df2a72425a6bc1422f329760b0d55fdf85d7f55705e5ed873917
- MD5 8be25920ef13f58d1d176e74994810bc
- SHA1 b0c3624b95ee46682987d3220c5bc4e25ade7a85
- SHA512 dc658b2af6287616826612d04464e1187f6c0b61826c601c9f5836a95fd42f97fdea778ec184a704f83d1eb8215631bd6480f8f1e8344a66c7767c19b90443e4
- SSDEEP 1572864:HYjYht9uhuZiPF+LnDQdvOhAy1wwPbLQECvVYmvnPKNbHlIrmIU:4jYht9guZoMLnEdvOhvVPnRmvPGbHh
- TLSH
  T199183381C8C35F9382A76C7D5D5B21022AE97B8DBDD1936F812D5D0662C3602A8B7F3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2524) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1