General
-
Target
190a621ed9d5471e03fbc7144f04b3ed0d94b5be2ab0c4bc1df345120986d19a
-
Size
66KB
-
Sample
210218-ndr6prtyxe
-
MD5
c9a3f59644226858255588cd5d3c6d56
-
SHA1
be1e18396b118b13cc2128ab7efbe11833dc4d53
-
SHA256
190a621ed9d5471e03fbc7144f04b3ed0d94b5be2ab0c4bc1df345120986d19a
-
SHA512
ba450f886ee9f24eed23298b8749dfa64ee4a48d70c89dcbaa3d10b6d3a9cd7bfdff377aae5f1a13ff9383e137be61eae6814c856df4325d108a2339a4683699
Static task
static1
Behavioral task
behavioral1
Sample
190a621ed9d5471e03fbc7144f04b3ed0d94b5be2ab0c4bc1df345120986d19a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
190a621ed9d5471e03fbc7144f04b3ed0d94b5be2ab0c4bc1df345120986d19a.exe
Resource
win10v20201028
Malware Config
Extracted
C:\$Recycle.Bin\HOW_TO_RECOVERY_FILES.txt
balaclava
Extracted
C:\$Recycle.Bin\HOW_TO_RECOVERY_FILES.txt
balaclava
Targets
-
-
Target
190a621ed9d5471e03fbc7144f04b3ed0d94b5be2ab0c4bc1df345120986d19a
-
Size
66KB
-
MD5
c9a3f59644226858255588cd5d3c6d56
-
SHA1
be1e18396b118b13cc2128ab7efbe11833dc4d53
-
SHA256
190a621ed9d5471e03fbc7144f04b3ed0d94b5be2ab0c4bc1df345120986d19a
-
SHA512
ba450f886ee9f24eed23298b8749dfa64ee4a48d70c89dcbaa3d10b6d3a9cd7bfdff377aae5f1a13ff9383e137be61eae6814c856df4325d108a2339a4683699
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-