General
-
Target
5d3b04d70760235f8a39ada7aca3fce9af81f6c0c3b418908a18d4086c81cfa6
-
Size
626KB
-
Sample
210511-83g5cey2na
-
MD5
b287ff0de4ca861a0aaf831cff074eb4
-
SHA1
1f3b64a80f4653670e1d1a4b8dd4b40158970dfa
-
SHA256
5d3b04d70760235f8a39ada7aca3fce9af81f6c0c3b418908a18d4086c81cfa6
-
SHA512
40ea96b2c24ecf70d2e7ec0ef0d9c7026b03e38881335e3f324ff2308c7e195d9e2d73f95636f987ba206afef0c38b9bfe1a64fb63e82d7c5f73c07cbecd817c
Static task
static1
Behavioral task
behavioral1
Sample
5d3b04d70760235f8a39ada7aca3fce9af81f6c0c3b418908a18d4086c81cfa6.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5d3b04d70760235f8a39ada7aca3fce9af81f6c0c3b418908a18d4086c81cfa6.exe
Resource
win10v20210410
Malware Config
Targets
-
-
Target
5d3b04d70760235f8a39ada7aca3fce9af81f6c0c3b418908a18d4086c81cfa6
-
Size
626KB
-
MD5
b287ff0de4ca861a0aaf831cff074eb4
-
SHA1
1f3b64a80f4653670e1d1a4b8dd4b40158970dfa
-
SHA256
5d3b04d70760235f8a39ada7aca3fce9af81f6c0c3b418908a18d4086c81cfa6
-
SHA512
40ea96b2c24ecf70d2e7ec0ef0d9c7026b03e38881335e3f324ff2308c7e195d9e2d73f95636f987ba206afef0c38b9bfe1a64fb63e82d7c5f73c07cbecd817c
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-