General
-
Target
66f7998447def77e69b8345e1078121a3df6178ff2b4f0fbb0902f3c609dd498
-
Size
1015KB
-
Sample
210511-zggy7b91cn
-
MD5
60db1ac59832f1a8296c74cfca342562
-
SHA1
aa5c61b45eac441111883d64aa0580181a83179c
-
SHA256
66f7998447def77e69b8345e1078121a3df6178ff2b4f0fbb0902f3c609dd498
-
SHA512
272b6b6d67aba525726e4be247697c1d2b5eebc00b1c0cde356f7622c277fb4baffd66789daf24f92b974008c060e7f8d980b15f1b809dbf9e3832d7a8946fb3
Static task
static1
Behavioral task
behavioral1
Sample
66f7998447def77e69b8345e1078121a3df6178ff2b4f0fbb0902f3c609dd498.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
66f7998447def77e69b8345e1078121a3df6178ff2b4f0fbb0902f3c609dd498.exe
Resource
win10v20210410
Malware Config
Targets
-
-
Target
66f7998447def77e69b8345e1078121a3df6178ff2b4f0fbb0902f3c609dd498
-
Size
1015KB
-
MD5
60db1ac59832f1a8296c74cfca342562
-
SHA1
aa5c61b45eac441111883d64aa0580181a83179c
-
SHA256
66f7998447def77e69b8345e1078121a3df6178ff2b4f0fbb0902f3c609dd498
-
SHA512
272b6b6d67aba525726e4be247697c1d2b5eebc00b1c0cde356f7622c277fb4baffd66789daf24f92b974008c060e7f8d980b15f1b809dbf9e3832d7a8946fb3
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-