a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74 | Triage

Resubmissions

25/07/2021, 14:36

210725-axvbkfmava 10

25/07/2021, 13:09

210725-p9et3vdq62 8

Analysis

max time kernel
61s
max time network
58s
platform
windows7_x64
resource
win7v20210410
submitted
25/07/2021, 14:36

Sharing

Report Analysis Logs

General

Target

WindowsFormsApp1.exe
Size

228KB
MD5

8c1344abfab3ca04edc09823d638791c
SHA1

b45968fef318759b3f82ae7759d0e284099e5617
SHA256

a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74
SHA512

9ded3851cb4ee2649639f19b2c2e882c4fecab4fa98114241dacc082d52d268c793ff082463395b8e57af8ccc69da46e016757b676d025c50e74b71da960622c

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\SetSearch.tif.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\UnblockWrite.crw.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\UnpublishUnregister.tiff.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\SearchInitialize.crw.FancyLeaks	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\SendRedo.tiff	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\PublishWrite.tif.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\RepairStep.crw.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\SendRedo.tiff.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\StepPush.tiff.FancyLeaks	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\StepPush.tiff	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishUnregister.tiff	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\DismountDebug.raw.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\HideEdit.tif.FancyLeaks	WindowsFormsApp1.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1.exe

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-59-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/1728-61-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1728-62-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/1728-63-0x0000000004DF5000-0x0000000004E06000-memory.dmp

Filesize
68KB

Download