General
-
Target
a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2.sample
-
Size
71KB
-
Sample
210726-t9axsqzd2a
-
MD5
e59ffeaf7acb0c326e452fa30bb71a36
-
SHA1
c88fad293256bfead6962124394de4f8b97765aa
-
SHA256
a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2
-
SHA512
737937ac074b1754878f9548be0fae43a18b88ed669a5626468763577d254ef4cd833686d3b9ed5a3169eb8dd1593ca03a74f5ba4664ccc1446d9b85d2f316b3
Static task
static1
Behavioral task
behavioral1
Sample
a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2.sample.exe
Resource
win10v20210410
Malware Config
Extracted
C:\users\public\desktop\info.hta
lockhelp@qq.com
lockhelp@xmpp.jp
https://pidgin.im/download/windows/
Extracted
C:\Users\Admin\Desktop\info.hta
lockhelp@qq.com
lockhelp@xmpp.jp
https://pidgin.im/download/windows/
Targets
-
-
Target
a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2.sample
-
Size
71KB
-
MD5
e59ffeaf7acb0c326e452fa30bb71a36
-
SHA1
c88fad293256bfead6962124394de4f8b97765aa
-
SHA256
a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2
-
SHA512
737937ac074b1754878f9548be0fae43a18b88ed669a5626468763577d254ef4cd833686d3b9ed5a3169eb8dd1593ca03a74f5ba4664ccc1446d9b85d2f316b3
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-