General
-
Target
1.exe
-
Size
3.3MB
-
Sample
210717-qdqgcndlqe
-
MD5
08684a98326e5e871ee7832859ff16da
-
SHA1
d43d471b3ba5a29edb0910ac5b8db6ce079fece2
-
SHA256
24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d
-
SHA512
1dacbc24d8acb82df6e9cc2f2659a11c4c7e495557c7ed7767538a6b936aa9b8754957e8c4cff52ac239ad5a122ae18374c92ec9a23cac308dd001ed22a1eee7
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v20210410
Malware Config
Targets
-
-
Target
1.exe
-
Size
3.3MB
-
MD5
08684a98326e5e871ee7832859ff16da
-
SHA1
d43d471b3ba5a29edb0910ac5b8db6ce079fece2
-
SHA256
24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d
-
SHA512
1dacbc24d8acb82df6e9cc2f2659a11c4c7e495557c7ed7767538a6b936aa9b8754957e8c4cff52ac239ad5a122ae18374c92ec9a23cac308dd001ed22a1eee7
Score10/10-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-