a29680c7dd33883aae332b022a1160c6380608ea7cb1c6d233475a5746f34a46

General

Target
ArexPayload.exe
Size 336KB
Sample261028-vg1q2asyes
SHA256 a29680c7dd33883aae332b022a1160c6380608ea7cb1c6d233475a5746f34a46
MD5 cd5bb650d92a037d237de70906a14e52
SHA1 9947d836ff51da6354eb5f6cf8bf9a7f2adc5571
SHA512 c492a2081bf15cc00fc08fc380aa223b1015079c5de56d60cb5f2874fc9d8c64ff1d9a16c1c55b95f136952e6e87acb288f7b5df9f109a7c6aa05975bc2b70aa
SSDEEP 6144:McB0wcdbitn/mut8KLR3WLybGeGhO7wbWh5MpjgaKwUak0KinGu43Cf26iW+tT:z+iVGeG6iAejga7UakqHf26H+t
TLSH
T13E74F12AEE5E00EAE119CA7CC7874A02BF33BC55536597CB53801D970E267D86F3D682
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  ArexPayload.exe
- Size 336KB
- SHA256 a29680c7dd33883aae332b022a1160c6380608ea7cb1c6d233475a5746f34a46
- MD5 cd5bb650d92a037d237de70906a14e52
- SHA1 9947d836ff51da6354eb5f6cf8bf9a7f2adc5571
- SHA512 c492a2081bf15cc00fc08fc380aa223b1015079c5de56d60cb5f2874fc9d8c64ff1d9a16c1c55b95f136952e6e87acb288f7b5df9f109a7c6aa05975bc2b70aa
- SSDEEP 6144:McB0wcdbitn/mut8KLR3WLybGeGhO7wbWh5MpjgaKwUak0KinGu43Cf26iW+tT:z+iVGeG6iAejga7UakqHf26H+t
- TLSH
  T13E74F12AEE5E00EAE119CA7CC7874A02BF33BC55536597CB53801D970E267D86F3D682
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence ransomware spyware stealer
- Renames multiple (211) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2