General
-
Target
3935efdd48fc122e4b10c068f06c53e4360aeabdba3b70c7958af79a208fda58
-
Size
592KB
-
Sample
220216-22ywhaebe2
-
MD5
365d6a237322d9e9423c139618010221
-
SHA1
3f025bc6ad85e19a259c38e224ccd8e482645126
-
SHA256
3935efdd48fc122e4b10c068f06c53e4360aeabdba3b70c7958af79a208fda58
-
SHA512
4fa65fb387532b1e04e94b9d8996c937cd90205094b7e168d8feda1d28ae9b871b4e3eb10ceced13c49fea5daabd9d0a7a280c838ba4e2472c94e7ef29f8bc94
Static task
static1
Behavioral task
behavioral1
Sample
3935efdd48fc122e4b10c068f06c53e4360aeabdba3b70c7958af79a208fda58.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3935efdd48fc122e4b10c068f06c53e4360aeabdba3b70c7958af79a208fda58.dll
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8f9a90bc0
https://mazedecrypt.top/6d570cc8f9a90bc0
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8d9154c1a
https://mazedecrypt.top/6c2b0cc8d9154c1a
Targets
-
-
Target
3935efdd48fc122e4b10c068f06c53e4360aeabdba3b70c7958af79a208fda58
-
Size
592KB
-
MD5
365d6a237322d9e9423c139618010221
-
SHA1
3f025bc6ad85e19a259c38e224ccd8e482645126
-
SHA256
3935efdd48fc122e4b10c068f06c53e4360aeabdba3b70c7958af79a208fda58
-
SHA512
4fa65fb387532b1e04e94b9d8996c937cd90205094b7e168d8feda1d28ae9b871b4e3eb10ceced13c49fea5daabd9d0a7a280c838ba4e2472c94e7ef29f8bc94
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-