General
-
Target
c4329600329d3a3d75710f1d1006d45ca54fd362e86e26eba475724e113a1326
-
Size
234KB
-
Sample
220216-2latqsfbbk
-
MD5
c1ee7d8dfa37e1a7b2963cda88935d86
-
SHA1
1466ada5ada91b7f4be369685a5d0d7e641b1ad5
-
SHA256
c4329600329d3a3d75710f1d1006d45ca54fd362e86e26eba475724e113a1326
-
SHA512
9ec887c3b412818fd7349737efa32fbafaff5ed300ef591ead2eae225338887e3ee214a7ac404b8701442190ad93a8a338e805b80fec8a7d5b50773ca32f21c3
Static task
static1
Behavioral task
behavioral1
Sample
c4329600329d3a3d75710f1d1006d45ca54fd362e86e26eba475724e113a1326.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c4329600329d3a3d75710f1d1006d45ca54fd362e86e26eba475724e113a1326.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6d570cc87eaca12a
https://mazedecrypt.top/6d570cc87eaca12a
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8a8935801
https://mazedecrypt.top/6c2b0cc8a8935801
Targets
-
-
Target
c4329600329d3a3d75710f1d1006d45ca54fd362e86e26eba475724e113a1326
-
Size
234KB
-
MD5
c1ee7d8dfa37e1a7b2963cda88935d86
-
SHA1
1466ada5ada91b7f4be369685a5d0d7e641b1ad5
-
SHA256
c4329600329d3a3d75710f1d1006d45ca54fd362e86e26eba475724e113a1326
-
SHA512
9ec887c3b412818fd7349737efa32fbafaff5ed300ef591ead2eae225338887e3ee214a7ac404b8701442190ad93a8a338e805b80fec8a7d5b50773ca32f21c3
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-