General
-
Target
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02
-
Size
31KB
-
Sample
220306-avq4jahfd9
-
MD5
e25e078255b56b47897ac96a7842de92
-
SHA1
21febfb36da69c8a611a9eaee5cc826cfd5684d7
-
SHA256
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02
-
SHA512
6ed5f9144996ad70ab9770ede191420ef12d69dd7833e0ec9064be0ec1959407c5971680e0a4bfc57a709853ea2d78c586a74f56f5d79874a5ab8f8adb45beb1
Static task
static1
Behavioral task
behavioral1
Sample
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
C:\MSOCache\How To Restore Your Files.txt
https://i.imgur.com/JZh2aDz.png
https://i.imgur.com/iKJ0m63.png
https://i.imgur.com/11DdeaB.png
https://i.imgur.com/9azjsKv.png
https://i.imgur.com/z6ry8kZ.png
https://i.imgur.com/tcryLE4.png
https://i.imgur.com/jruCjYx.png
https://i.imgur.com/vJJQxM1.png
http://babukq4e2p4wu4iq.onion/login.php?id=QQDgjfAG8pLYTBufjrVjnBg3iPAnSK
Targets
-
-
Target
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02
-
Size
31KB
-
MD5
e25e078255b56b47897ac96a7842de92
-
SHA1
21febfb36da69c8a611a9eaee5cc826cfd5684d7
-
SHA256
1b9412ca5e9deb29aeaa37be05ae8d0a8a636c12fdff8c17032aa017f6075c02
-
SHA512
6ed5f9144996ad70ab9770ede191420ef12d69dd7833e0ec9064be0ec1959407c5971680e0a4bfc57a709853ea2d78c586a74f56f5d79874a5ab8f8adb45beb1
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-