General
-
Target
d9ac8cb2cac5a0eb7a96d928cb3c384c747813eed62e5acbcc58989341d4b742
-
Size
1.6MB
-
Sample
210511-e45j77qmzn
-
MD5
2b8c9b2b7c5a2700f69abaaaae527c40
-
SHA1
fa0deb5fb3a10c75538edf79a79aeff532ed7bc5
-
SHA256
d9ac8cb2cac5a0eb7a96d928cb3c384c747813eed62e5acbcc58989341d4b742
-
SHA512
310acbe057d2efe25265712b3a60db46ea32a68775b3857e712dccf2cd89afe3df78e7b90a123de262927a09a8d2f28a17f590be7ed658e0487851c2eda3421b
Static task
static1
Behavioral task
behavioral1
Sample
d9ac8cb2cac5a0eb7a96d928cb3c384c747813eed62e5acbcc58989341d4b742.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
d9ac8cb2cac5a0eb7a96d928cb3c384c747813eed62e5acbcc58989341d4b742.exe
Resource
win10v20210408
Malware Config
Targets
-
-
Target
d9ac8cb2cac5a0eb7a96d928cb3c384c747813eed62e5acbcc58989341d4b742
-
Size
1.6MB
-
MD5
2b8c9b2b7c5a2700f69abaaaae527c40
-
SHA1
fa0deb5fb3a10c75538edf79a79aeff532ed7bc5
-
SHA256
d9ac8cb2cac5a0eb7a96d928cb3c384c747813eed62e5acbcc58989341d4b742
-
SHA512
310acbe057d2efe25265712b3a60db46ea32a68775b3857e712dccf2cd89afe3df78e7b90a123de262927a09a8d2f28a17f590be7ed658e0487851c2eda3421b
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-