10848b44aa931cd22b542687cbadba98d93110228731eed104600fdc81e283d1

General

Target
SecurityHealthSystray.exe
Size 89.0MB
Sample261014-e4pz2sv16r
SHA256 10848b44aa931cd22b542687cbadba98d93110228731eed104600fdc81e283d1
MD5 0e5079ed859d98b996142e8640189da8
SHA1 587842f76c919775fb9b094a4c5806fec8be2459
SHA512 867812bca3440d575650160ad5444b8295e1d53227849286b7bc40b71b9500481cff815d4fe4f6cb908db6116abdf82f34ab8bb58a2e9369b0fc42c286999cdf
SSDEEP 1572864:nHhUyRirpEXLL7fEVNkK31RArVgIaTBYkAVliVJQhA8Xk5uMtMMN1zPcJNpAnYCl:nHtirOnUH8hGWliVChA8XkbpcPAYdu
TLSH
T1251833FAC0B72AC566CDCB3C06A07C7149E5BC58DCA9422F3251E96159E3307BB90ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SecurityHealthSystray.exe
- Size 89.0MB
- SHA256 10848b44aa931cd22b542687cbadba98d93110228731eed104600fdc81e283d1
- MD5 0e5079ed859d98b996142e8640189da8
- SHA1 587842f76c919775fb9b094a4c5806fec8be2459
- SHA512 867812bca3440d575650160ad5444b8295e1d53227849286b7bc40b71b9500481cff815d4fe4f6cb908db6116abdf82f34ab8bb58a2e9369b0fc42c286999cdf
- SSDEEP 1572864:nHhUyRirpEXLL7fEVNkK31RArVgIaTBYkAVliVJQhA8Xk5uMtMMN1zPcJNpAnYCl:nHtirOnUH8hGWliVChA8XkbpcPAYdu
- TLSH
  T1251833FAC0B72AC566CDCB3C06A07C7149E5BC58DCA9422F3251E96159E3307BB90ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2026) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1