a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74

Resubmissions

25/07/2021, 14:36

25/07/2021, 13:09

Target

WindowsFormsApp1.exe
Size

228KB
MD5

8c1344abfab3ca04edc09823d638791c
SHA1

b45968fef318759b3f82ae7759d0e284099e5617
SHA256

a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74
SHA512

9ded3851cb4ee2649639f19b2c2e882c4fecab4fa98114241dacc082d52d268c793ff082463395b8e57af8ccc69da46e016757b676d025c50e74b71da960622c

Score

8^/10

ransomware

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\DenyUnlock.tiff.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\MountStart.png.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\MoveExport.tif.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\SetUnlock.tiff.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\UnprotectApprove.tif.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\PushExit.tiff.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\SendConvertFrom.png.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\SetStep.tiff.FancyLeaks	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\SetStep.tiff	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\StepUnpublish.raw.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\AddUnlock.tif.FancyLeaks	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\DenyUnlock.tiff	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\PushExit.tiff	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\SetUnlock.tiff	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\ReadAdd.raw.FancyLeaks	WindowsFormsApp1.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1.exe

memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/804-116-0x0000000005650000-0x0000000005651000-memory.dmp

Filesize
4KB

Download
memory/804-117-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/804-118-0x0000000005150000-0x000000000564E000-memory.dmp

Filesize
5.0MB

Download
memory/804-119-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/804-120-0x0000000005150000-0x000000000564E000-memory.dmp

Filesize
5.0MB

Download