General
-
Target
0ed55db21a1a5eeca96605f870cb6d4ddf1277e1e257371e75d6ee9e1507b216
-
Size
147KB
-
Sample
211102-s5jfjshccp
-
MD5
86ad533921708b0668096db5c7625412
-
SHA1
5fa4eea3b307a2de4de5e86620f40aa83e0c7938
-
SHA256
0ed55db21a1a5eeca96605f870cb6d4ddf1277e1e257371e75d6ee9e1507b216
-
SHA512
a1af898f3b2ef1d01e3406dfc1acb4bafb9f9931de9005d33f1c17bccbdf0b27abd0d20e2d00771ccf1ce4920836145c7f70e4b913b4ceb350bdf0fa889b27ea
Static task
static1
Behavioral task
behavioral1
Sample
0ed55db21a1a5eeca96605f870cb6d4ddf1277e1e257371e75d6ee9e1507b216.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
0ed55db21a1a5eeca96605f870cb6d4ddf1277e1e257371e75d6ee9e1507b216.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
http://spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion/chat.php?track=NMU7PHR3V5
Targets
-
-
Target
0ed55db21a1a5eeca96605f870cb6d4ddf1277e1e257371e75d6ee9e1507b216
-
Size
147KB
-
MD5
86ad533921708b0668096db5c7625412
-
SHA1
5fa4eea3b307a2de4de5e86620f40aa83e0c7938
-
SHA256
0ed55db21a1a5eeca96605f870cb6d4ddf1277e1e257371e75d6ee9e1507b216
-
SHA512
a1af898f3b2ef1d01e3406dfc1acb4bafb9f9931de9005d33f1c17bccbdf0b27abd0d20e2d00771ccf1ce4920836145c7f70e4b913b4ceb350bdf0fa889b27ea
Score10/10-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-