e15188f451c3de8e0514ebb6058f9392b91cee40dc07e5425f471f3543447e13

General

Target
SecurityHealthSystray.exe
Size 89.0MB
Sample261014-fdvnaaee47
SHA256 e15188f451c3de8e0514ebb6058f9392b91cee40dc07e5425f471f3543447e13
MD5 e3e0fe1a396118251f7f7bc78a717a8c
SHA1 de200c6f309e5adc92dd030c98e9778b55f55f6a
SHA512 3858559b87f3ec96c27aef86ff6df446b5950da7d20d27c43c42387229f54eb1155a489c4b696fcec01a0cae91af67c8310764e2a06e173521a7dffb2fbd1e03
SSDEEP 1572864:kzjp7BmO1bET2E6/mWu2m4Cib9ZQ+qnfmkRe6meKih+aKQsP7uWimBkTVonk+YCl:k57BZ1b62Esmpi8tnfm/6mo+Z5BCoYdu
TLSH
T1931833FAD8770AAA7893715CAE487FA14C25F5149D31C40F3699CE49C693B037CA6B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  SecurityHealthSystray.exe
- Size 89.0MB
- SHA256 e15188f451c3de8e0514ebb6058f9392b91cee40dc07e5425f471f3543447e13
- MD5 e3e0fe1a396118251f7f7bc78a717a8c
- SHA1 de200c6f309e5adc92dd030c98e9778b55f55f6a
- SHA512 3858559b87f3ec96c27aef86ff6df446b5950da7d20d27c43c42387229f54eb1155a489c4b696fcec01a0cae91af67c8310764e2a06e173521a7dffb2fbd1e03
- SSDEEP 1572864:kzjp7BmO1bET2E6/mWu2m4Cib9ZQ+qnfmkRe6meKih+aKQsP7uWimBkTVonk+YCl:k57BZ1b62Esmpi8tnfm/6mo+Z5BCoYdu
- TLSH
  T1931833FAD8770AAA7893715CAE487FA14C25F5149D31C40F3699CE49C693B037CA6B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer upx
- Clears Windows event logs
  defense_evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (2051) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1