Resubmissions
29-10-2021 12:12
211029-pdkbzsaaap 10General
-
Target
32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
-
Size
152KB
-
Sample
211029-pdkbzsaaap
-
MD5
af9622a8b6a46866f00f9ff35b7f16b6
-
SHA1
6a81a6e01f502cdb5893d423417bde2448882ac2
-
SHA256
32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
-
SHA512
e4effba4959ff985bd63cd0f533c368c88370a25c90eef5e9bef82eab101d2ea1a2bbd33aad1da3cb629b894c2777c8f6c35fd6729b65b8580c54f90a13fb2c2
Static task
static1
Behavioral task
behavioral1
Sample
32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=PUUEQS8AEJ
Targets
-
-
Target
32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
-
Size
152KB
-
MD5
af9622a8b6a46866f00f9ff35b7f16b6
-
SHA1
6a81a6e01f502cdb5893d423417bde2448882ac2
-
SHA256
32ec78179b1516765fd2ec4da82404352cb6837a906c7493283ef578930273e6
-
SHA512
e4effba4959ff985bd63cd0f533c368c88370a25c90eef5e9bef82eab101d2ea1a2bbd33aad1da3cb629b894c2777c8f6c35fd6729b65b8580c54f90a13fb2c2
Score10/10-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-