Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
25/07/2021, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
WindowsFormsApp1.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
WindowsFormsApp1.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
WindowsFormsApp1.exe
-
Size
228KB
-
MD5
8c1344abfab3ca04edc09823d638791c
-
SHA1
b45968fef318759b3f82ae7759d0e284099e5617
-
SHA256
a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74
-
SHA512
9ded3851cb4ee2649639f19b2c2e882c4fecab4fa98114241dacc082d52d268c793ff082463395b8e57af8ccc69da46e016757b676d025c50e74b71da960622c
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ExitSelect.tiff.FancyLeaks WindowsFormsApp1.exe File created C:\Users\Admin\Pictures\HideAdd.tiff.FancyLeaks WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Pictures\HideAdd.tiff WindowsFormsApp1.exe File created C:\Users\Admin\Pictures\ProtectWrite.raw.FancyLeaks WindowsFormsApp1.exe File created C:\Users\Admin\Pictures\SetInstall.tiff.FancyLeaks WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Pictures\SetInstall.tiff WindowsFormsApp1.exe File created C:\Users\Admin\Pictures\AddDebug.crw.FancyLeaks WindowsFormsApp1.exe File created C:\Users\Admin\Pictures\ConvertFromStart.crw.FancyLeaks WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Pictures\ExitSelect.tiff WindowsFormsApp1.exe File created C:\Users\Admin\Pictures\ReceiveWait.tif.FancyLeaks WindowsFormsApp1.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini WindowsFormsApp1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini WindowsFormsApp1.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe 1096 WindowsFormsApp1.exe