aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282

General

Target
aedbaf7d4380ee4f.exe
Size 2.1MB
Sample261111-265jvasvf1
SHA256 aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282
MD5 bb8011606fea0751304de45ccc422614
SHA1 666c7eef65f61054044ee416410f471a3ac2c4e0
SHA512 e80e3fbc7b671b86033d5b6a6104bd86b1d9abe0f73f314d568198925cf493cc9d970f102c1160fb09fbde82e975562935a4c30cafcd22b78c46c07aa8e88b94
SSDEEP 12288:R7KhpcYL1DebKZplDmrcX/GA5mIqYkQrw9bg5rIszXDTRx7GBHK9/tI7pXrJQRkj:ZKb1L3ZplircX+AMoicRpXhkusQrj7c
TLSH
T1C8A53B0377C7ADF6C8932B74AAEF132C5721EE305F6A0B7F554882345D532E8AD0A691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  aedbaf7d4380ee4f.exe
- Size 2.1MB
- SHA256 aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282
- MD5 bb8011606fea0751304de45ccc422614
- SHA1 666c7eef65f61054044ee416410f471a3ac2c4e0
- SHA512 e80e3fbc7b671b86033d5b6a6104bd86b1d9abe0f73f314d568198925cf493cc9d970f102c1160fb09fbde82e975562935a4c30cafcd22b78c46c07aa8e88b94
- SSDEEP 12288:R7KhpcYL1DebKZplDmrcX/GA5mIqYkQrw9bg5rIszXDTRx7GBHK9/tI7pXrJQRkj:ZKb1L3ZplircX+AMoicRpXhkusQrj7c
- TLSH
  T1C8A53B0377C7ADF6C8932B74AAEF132C5721EE305F6A0B7F554882345D532E8AD0A691
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Indicator Removal: Network Share Connection Removal
  Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Creates new service(s)
  persistence execution
- Modifies file permissions
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Creates a new local user account
  Uses net.exe to create a new local user account, often for persistence or a backdoor account.
  persistence
- Drops file in System32 directory
behavioral1 behavioral2