General
-
Target
765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a
-
Size
51KB
-
Sample
220211-hknvesdfdr
-
MD5
2692c25d30fcf69479ec57f07c34dfc4
-
SHA1
ffe82e80f65d548195afb67da3d4c592d96ca3c2
-
SHA256
765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a
-
SHA512
4e000993d203372fee742bec8b1b5ec938e0b0d5e9b5cad4590ef0df215f465696c64d58cfabd914f91e92f81bdb37fae092758dd0e90204b67f4b66e88d6b1c
Static task
static1
Behavioral task
behavioral1
Sample
765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\Read this message.txt
Extracted
C:\Read this message.txt
Targets
-
-
Target
765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a
-
Size
51KB
-
MD5
2692c25d30fcf69479ec57f07c34dfc4
-
SHA1
ffe82e80f65d548195afb67da3d4c592d96ca3c2
-
SHA256
765986adf512bc085a16fc6043e2867b591e4ff177cb814e658e4041a57eeb6a
-
SHA512
4e000993d203372fee742bec8b1b5ec938e0b0d5e9b5cad4590ef0df215f465696c64d58cfabd914f91e92f81bdb37fae092758dd0e90204b67f4b66e88d6b1c
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-