General
-
Target
sqlservr.exe
-
Size
1.8MB
-
Sample
210920-dkqa2acga3
-
MD5
e1338c42da2d2363afbbd0eeabad1ca9
-
SHA1
fe5d669b732c9227bb25787083906f49b732c335
-
SHA256
61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e
-
SHA512
bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a
Static task
static1
Behavioral task
behavioral1
Sample
sqlservr.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
sqlservr.exe
Resource
win10-en
Malware Config
Extracted
C:\Read Me.TXT
Extracted
C:\Read Me.TXT
Targets
-
-
Target
sqlservr.exe
-
Size
1.8MB
-
MD5
e1338c42da2d2363afbbd0eeabad1ca9
-
SHA1
fe5d669b732c9227bb25787083906f49b732c335
-
SHA256
61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e
-
SHA512
bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a
Score10/10-
Clears Windows event logs
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Modifies WinLogon
-