General
-
Target
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015
-
Size
363KB
-
Sample
220216-2ma6wsdhe8
-
MD5
f83cef2bf33a4d43e58b771e81af3ecc
-
SHA1
12133b783cef924cbc2911deb11cba148d97dad4
-
SHA256
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015
-
SHA512
0d0ed1846d8cf5cba89c1eaa952110b420b4ef0684f4b4c00bd7db47e5d6f72639a90e3725520b5502dbfe35b8a875256b5163bcee25b2264d0e2dfe210e5c9a
Static task
static1
Behavioral task
behavioral1
Sample
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc576131fb1
https://mazedecrypt.top/6c610cc576131fb1
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc87c8f6f0e
https://mazedecrypt.top/6c2b0cc87c8f6f0e
Targets
-
-
Target
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015
-
Size
363KB
-
MD5
f83cef2bf33a4d43e58b771e81af3ecc
-
SHA1
12133b783cef924cbc2911deb11cba148d97dad4
-
SHA256
bba288819f375cbdd1a274609924aeba786e1d1b43065846a85e30bc998d9015
-
SHA512
0d0ed1846d8cf5cba89c1eaa952110b420b4ef0684f4b4c00bd7db47e5d6f72639a90e3725520b5502dbfe35b8a875256b5163bcee25b2264d0e2dfe210e5c9a
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Sets desktop wallpaper using registry
-