General
-
Target
c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
-
Size
156KB
-
Sample
211213-h396dadcf2
-
MD5
4a2c7295771216a38836758181eb0ac6
-
SHA1
d197da3c3966469ed7488d09bbfbc0098b0a337a
-
SHA256
c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9
-
SHA512
e28bc8a22dedcd5bdb0f5ce0a807db31e79cd1870efafbb7ad19a4f6723699ae1e11ddb1262754d285608b05b9121c242e4cc976e319ebbbd850715bac2832a9
Static task
static1
Behavioral task
behavioral1
Sample
c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20211208_144704667-MSI_netfx_Full_x64.msi.txt
ryuk
Targets
-
-
Target
c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9.exe
-
Size
156KB
-
MD5
4a2c7295771216a38836758181eb0ac6
-
SHA1
d197da3c3966469ed7488d09bbfbc0098b0a337a
-
SHA256
c3e2744b2214c3671416bbd4014d9647307a51e88950268be225be32ed672ca9
-
SHA512
e28bc8a22dedcd5bdb0f5ce0a807db31e79cd1870efafbb7ad19a4f6723699ae1e11ddb1262754d285608b05b9121c242e4cc976e319ebbbd850715bac2832a9
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops desktop.ini file(s)
-