007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2

Resubmissions

04/11/2026, 16:57

261104-vgfqvsys7k10

01/02/2022, 08:40

220201-kk2sdsbfan10

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-en-20211208
submitted
01/02/2022, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe
Size 728KB
Sample220201-kk2sdsbfan
SHA256 007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2
MD5 3867aff469391fba964309a4ba7a8ca2
SHA1 e2a224ef5764f4b34b51abbc0ada10ea1d0dc0a9
SHA512 73b56d1c9301dc9f385b99653c059c418ca633d51282affdad72be34d2b68022612ead62207cce353cb79304b5e48d79ae609264522519bb8efe38f2bf7f0b8a
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\__________WHY FILES NOT WORK__________.txt

Ransom Note

Attention! Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team! We used nextgen strong cryptography in order to encrypt your files. The only way to restore your files is to buy decryptor! * You must know the worst thing is happened now and you cannot hide our successful attack! Understand if payment is not made on time. All your company data will be permanently destroyed. Your backups has been fatal and it is just a waste of your precious time if going to try them! * IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW 1. Copy your Network ID and send to our email. Network ID : DM5V6T52K4 Email : [email protected] 2. You will receive a amount and payment order. 3. We will send you decryptor with private key to recovery your files. * You can ask for 1 free file decryption as proof of work in the first correspondence! * Your time for save your files has limited to one week (from first impact) before we delete our temporary email address! * Data manipulation cause permanent loss of files!

Emails

[email protected]

Signatures

Deletes itself 1 IoCs

pid	Process
1928	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1324	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1564	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1928	1564	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	29
PID 1564 wrote to memory of 1928	1564	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	29
PID 1564 wrote to memory of 1928	1564	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	29
PID 1564 wrote to memory of 1928	1564	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	29
PID 1928 wrote to memory of 1324	1928	cmd.exe	31
PID 1928 wrote to memory of 1324	1928	cmd.exe	31
PID 1928 wrote to memory of 1324	1928	cmd.exe	31
PID 1928 wrote to memory of 1324	1928	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe
"C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C ping 127.0.0.1 -n 5 > NUL && del /Q /F "C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads