78aef5fa0e1c3e24014df83d228034c2939c2823f757fe09a6d3fa59b751030b

General

Target
ofx.exe
Size 515KB
Sample261025-sfwpkshc45
SHA256 78aef5fa0e1c3e24014df83d228034c2939c2823f757fe09a6d3fa59b751030b
MD5 0f0e6f0341e19ae3cb2b2105e0c006b3
SHA1 86a4b4f421835600ae37ee62c21c8350fe45ae9f
SHA512 a8ac915d9cc2df8513055477a00550eb02d9346072b239dc20ca7bd91ab522b9a550bfb236bde1592a57c00a6b723e7f161b33b0c2595f1a3436155f84f4a8ae
SSDEEP 6144:nMqzPTLmgiBwQkxcCYgTcZ7a+hJ7ClfoAHFGZDTwnYkWNpCYKiNYPBksmb/gFlZn:n7zl+kJ7ynQhc/h7+RbBuePz/
TLSH
T13AB48D65A6A807FDD173D1B8DE625902E732788A0331AEDB038059B61F276D58F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ofx.exe
- Size 515KB
- SHA256 78aef5fa0e1c3e24014df83d228034c2939c2823f757fe09a6d3fa59b751030b
- MD5 0f0e6f0341e19ae3cb2b2105e0c006b3
- SHA1 86a4b4f421835600ae37ee62c21c8350fe45ae9f
- SHA512 a8ac915d9cc2df8513055477a00550eb02d9346072b239dc20ca7bd91ab522b9a550bfb236bde1592a57c00a6b723e7f161b33b0c2595f1a3436155f84f4a8ae
- SSDEEP 6144:nMqzPTLmgiBwQkxcCYgTcZ7a+hJ7ClfoAHFGZDTwnYkWNpCYKiNYPBksmb/gFlZn:n7zl+kJ7ynQhc/h7+RbBuePz/
- TLSH
  T13AB48D65A6A807FDD173D1B8DE625902E732788A0331AEDB038059B61F276D58F3FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence ransomware spyware stealer trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Enumerates VirtualBox registry keys
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (1406) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Disables use of System Restore points
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral1