Static task
static1
Behavioral task
behavioral1
Sample
Ransom.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Ransom.exe
Resource
win10v2004-en-20220112
General
-
Target
Ransom.exe
-
Size
127KB
-
MD5
1f6297d8f742cb578bfa59735120326b
-
SHA1
ff6eca213cad5c2a139fc0dc0dc6a8e6d3df7b17
-
SHA256
3f843cbffeba010445dae2b171caaa99c6b56360de5407da71210d007fe26673
-
SHA512
f9ade063be2ae5861248472aff857b2e0506d4705ff779972ade7482bb7797521338dd9a842f048d5ba1697719b22a3ba596370c37f4352a2527dbe1997edfd1
-
SSDEEP
3072:AJ+vDJMMKvaJw4N7JPohaNviHZoJ8J58:AIDmMKCJwc7JPoYNvf
Malware Config
Signatures
-
TargetCompany Payload 1 IoCs
resource yara_rule sample family_targetcompany -
resource yara_rule sample family_targetcompany_v2 -
Targetcompany family
Files
-
Ransom.exe.exe windows x86
1c1a27cb29df6923d860b330c9f7a54f
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
Sleep
CopyFileW
LeaveCriticalSection
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
lstrcatA
lstrcmpW
MultiByteToWideChar
GetFileSizeEx
GetLastError
GetProcAddress
MoveFileW
EnterCriticalSection
FindClose
PostQueuedCompletionStatus
DeviceIoControl
GetSystemInfo
WaitForMultipleObjects
Process32NextW
lstrcmpiW
CreateIoCompletionPort
GetModuleHandleA
lstrcatW
FindNextFileW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetCurrentThreadId
OpenProcess
CloseHandle
GetWindowsDirectoryW
GetCurrentProcessId
LocalFree
lstrcpyW
CreateThread
FindVolumeClose
SetEvent
TerminateThread
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetFileType
CreateEventW
QueryDosDeviceW
DuplicateHandle
FindFirstVolumeW
InitializeCriticalSection
GetUserDefaultLangID
WriteFile
GetCurrentThread
GetTickCount
GetModuleHandleW
FindFirstFileExW
GetLogicalDrives
WaitForSingleObject
QueryPerformanceCounter
SetFilePointerEx
GetCurrentProcess
GetQueuedCompletionStatus
InterlockedIncrement
SetErrorMode
GetDriveTypeW
lstrlenA
GetComputerNameA
GetCommandLineW
ExitProcess
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetDiskFreeSpaceExW
lstrlenW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapSize
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
advapi32
LookupPrivilegeValueW
LsaFreeMemory
AdjustTokenPrivileges
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
CryptGenRandom
LsaClose
StartServiceW
CreateServiceW
SetNamedSecurityInfoW
CryptReleaseContext
LsaOpenPolicy
OpenSCManagerW
OpenThreadToken
LsaQueryInformationPolicy
CryptAcquireContextW
OpenProcessToken
CloseServiceHandle
shell32
CommandLineToArgvW
ShellExecuteW
netapi32
NetApiBufferFree
NetShareEnum
shlwapi
wnsprintfW
StrStrIW
SHDeleteKeyW
StrCmpNIW
StrCmpNW
wnsprintfA
iphlpapi
GetIpNetTable
ws2_32
inet_ntoa
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetQueryOptionW
InternetQueryDataAvailable
InternetCrackUrlW
InternetConnectW
HttpSendRequestW
InternetSetOptionW
HttpOpenRequestW
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ