General
-
Target
0fb01d846e2682ed2507367d2d4537c45800304410b270a13e94f1ca778d161e
-
Size
365KB
-
Sample
220216-26az8sebh3
-
MD5
8bb9bf4b8be1141c4cdc4d435bfe7d0e
-
SHA1
dfc77a86fb58c2aa04b6b0399eea6dd0d642baa0
-
SHA256
0fb01d846e2682ed2507367d2d4537c45800304410b270a13e94f1ca778d161e
-
SHA512
6f17104ad9a11bd84a917a9d6ca285ffdef0fbda3645b936e271be9c3ed1c92abbaa63322c826cf10663a013593e975d42b355c1b5e828e24eda31c143a0e94e
Static task
static1
Behavioral task
behavioral1
Sample
0fb01d846e2682ed2507367d2d4537c45800304410b270a13e94f1ca778d161e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0fb01d846e2682ed2507367d2d4537c45800304410b270a13e94f1ca778d161e.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc8c4572a70
https://mazedecrypt.top/6d570cc8c4572a70
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc81410dec6
https://mazedecrypt.top/6c2b0cc81410dec6
Targets
-
-
Target
0fb01d846e2682ed2507367d2d4537c45800304410b270a13e94f1ca778d161e
-
Size
365KB
-
MD5
8bb9bf4b8be1141c4cdc4d435bfe7d0e
-
SHA1
dfc77a86fb58c2aa04b6b0399eea6dd0d642baa0
-
SHA256
0fb01d846e2682ed2507367d2d4537c45800304410b270a13e94f1ca778d161e
-
SHA512
6f17104ad9a11bd84a917a9d6ca285ffdef0fbda3645b936e271be9c3ed1c92abbaa63322c826cf10663a013593e975d42b355c1b5e828e24eda31c143a0e94e
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-