General
-
Target
b9018a268cf70981051bfdfa58cfa98c9dd222c17d9188b811b5660a3c2c59de
-
Size
147KB
-
Sample
211029-pastysdcb3
-
MD5
59f9c44f79f86a42138b77caaa4404c9
-
SHA1
2f32d3cdbd8bec75a605bec112d3fac8e0ea4e6d
-
SHA256
b9018a268cf70981051bfdfa58cfa98c9dd222c17d9188b811b5660a3c2c59de
-
SHA512
971d397e0684515a221ce3e89cb1651283a402de5e6c96cbf863313a57b1bc6aabe199e4fd75c4ff9dbc868346de45de838aceac9da60b6215bf283a2a1fb773
Static task
static1
Behavioral task
behavioral1
Sample
b9018a268cf70981051bfdfa58cfa98c9dd222c17d9188b811b5660a3c2c59de.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
b9018a268cf70981051bfdfa58cfa98c9dd222c17d9188b811b5660a3c2c59de.exe
Resource
win10-en-20210920
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=R4131MNE85
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=R4131MNE85
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=R4131MNE85
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=R4131MNE85
Targets
-
-
Target
b9018a268cf70981051bfdfa58cfa98c9dd222c17d9188b811b5660a3c2c59de
-
Size
147KB
-
MD5
59f9c44f79f86a42138b77caaa4404c9
-
SHA1
2f32d3cdbd8bec75a605bec112d3fac8e0ea4e6d
-
SHA256
b9018a268cf70981051bfdfa58cfa98c9dd222c17d9188b811b5660a3c2c59de
-
SHA512
971d397e0684515a221ce3e89cb1651283a402de5e6c96cbf863313a57b1bc6aabe199e4fd75c4ff9dbc868346de45de838aceac9da60b6215bf283a2a1fb773
Score10/10-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-