a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74

Resubmissions

25/07/2021, 14:36

25/07/2021, 13:09

Target

WindowsFormsApp1.exe
Size

228KB
MD5

8c1344abfab3ca04edc09823d638791c
SHA1

b45968fef318759b3f82ae7759d0e284099e5617
SHA256

a3bc02793e389eca1d2d3eab3ad4925b50ad90d64d66e418789b62144a5f8f74
SHA512

9ded3851cb4ee2649639f19b2c2e882c4fecab4fa98114241dacc082d52d268c793ff082463395b8e57af8ccc69da46e016757b676d025c50e74b71da960622c

Score

8^/10

ransomware

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\UpdateRepair.tif.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\ExportDeny.tiff.FancyLeaks	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\ExportDeny.tiff	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\FormatSplit.raw.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\RedoConvertTo.tif.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\SetFormat.png.FancyLeaks	WindowsFormsApp1.exe
File created	C:\Users\Admin\Pictures\UnprotectResolve.tiff.FancyLeaks	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\UnprotectResolve.tiff	WindowsFormsApp1.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	WindowsFormsApp1.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	WindowsFormsApp1.exe

memory/3008-114-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/3008-116-0x0000000005D40000-0x0000000005D41000-memory.dmp

Filesize
4KB

Download
memory/3008-117-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/3008-118-0x0000000005840000-0x0000000005D3E000-memory.dmp

Filesize
5.0MB

Download
memory/3008-119-0x00000000033A0000-0x00000000033A1000-memory.dmp

Filesize
4KB

Download
memory/3008-120-0x0000000005840000-0x0000000005D3E000-memory.dmp

Filesize
5.0MB

Download