cf5182d939bdbe023f6af72c30c35a03b23f3e0e79d39d01140e82f62a3a8024

General

Target
IronChain.exe
Size 17.0MB
Sample261028-rlht8sdw7j
SHA256 cf5182d939bdbe023f6af72c30c35a03b23f3e0e79d39d01140e82f62a3a8024
MD5 f4a632c368352294f74b9ff523321479
SHA1 74e6e257ae9bc5ba60b3085b7ab35f5e49eb2274
SHA512 d5095b627ac0de1be87478cdd2c537e8aa424edad8d70c5fc962737ee5e14f3c0ed322443f78223ee762b660b0ba7650a09e9a82a077dc98f5068ab1197d8a00
SSDEEP 393216:YUnUMNM1I0KQRvDq/vwUd1Fndq1B7eEtOqzGHsn4qS25ZpOG5:POy0KQRDq/Pd1Fng1IqzsgzSqZp
TLSH
T1AC07334957B30697ECDBD0396A72869BD1B27B0067219B9F0B5043AE3E6B1F31937360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  IronChain.exe
- Size 17.0MB
- SHA256 cf5182d939bdbe023f6af72c30c35a03b23f3e0e79d39d01140e82f62a3a8024
- MD5 f4a632c368352294f74b9ff523321479
- SHA1 74e6e257ae9bc5ba60b3085b7ab35f5e49eb2274
- SHA512 d5095b627ac0de1be87478cdd2c537e8aa424edad8d70c5fc962737ee5e14f3c0ed322443f78223ee762b660b0ba7650a09e9a82a077dc98f5068ab1197d8a00
- SSDEEP 393216:YUnUMNM1I0KQRvDq/vwUd1Fndq1B7eEtOqzGHsn4qS25ZpOG5:POy0KQRDq/Pd1Fng1IqzsgzSqZp
- TLSH
  T1AC07334957B30697ECDBD0396A72869BD1B27B0067219B9F0B5043AE3E6B1F31937360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation pyinstaller ransomware exploit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Creates new service(s)
  persistence execution
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2 behavioral3 behavioral4