General
-
Target
7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe
-
Size
13KB
-
Sample
211121-qfxwjadhfq
-
MD5
d109e80eff2ed00ee76147306057b78e
-
SHA1
ebdcaa6e32ae696725158482e0a7480d4c8433e5
-
SHA256
7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42
-
SHA512
23ef87e942a02f9347b07044a3fa291558b425c57c6bc66f14a367fcd89f61617785da560e175d8a225398189a37745295e199d93d3ead75118ebee792e3dada
Static task
static1
Behavioral task
behavioral1
Sample
7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe
Resource
win10-en-20211104
Malware Config
Extracted
C:\$Recycle.Bin\#File.decrypt#.txt
Extracted
C:\Program Files\Microsoft Office\Updates\Apply\#File.decrypt#.txt
Targets
-
-
Target
7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42.exe
-
Size
13KB
-
MD5
d109e80eff2ed00ee76147306057b78e
-
SHA1
ebdcaa6e32ae696725158482e0a7480d4c8433e5
-
SHA256
7c1f5cf8f242dfbd920180d8423777a4e540c37c09d787d4674b259bdbe0dc42
-
SHA512
23ef87e942a02f9347b07044a3fa291558b425c57c6bc66f14a367fcd89f61617785da560e175d8a225398189a37745295e199d93d3ead75118ebee792e3dada
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-
Drops desktop.ini file(s)
-