Analysis
-
max time kernel
149s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-04-2022 05:55
Static task
static1
Behavioral task
behavioral1
Sample
Rasomware2.0.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Rasomware2.0.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Rasomware2.0.exe
-
Size
824KB
-
MD5
7d17a868abac9de81fe79087eee31471
-
SHA1
2d3f58ea051db43964243b8aefb7279e45e7bda9
-
SHA256
1d871d84ee02630558411e47c81ef2aa8bef8f6cd8daaf594f133f545f772c26
-
SHA512
85ec6c3cf0908b306712041fc9d971d27349641245c29f126e01443dcc6ccd78530c789b15d345938c194009c890b42f7c95bc65deae1ef7372e5744651f9540
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Rasomware2.0.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" Rasomware2.0.exe -
Disables Task Manager via registry modification
-
Drops desktop.ini file(s) 1 IoCs
Processes:
Rasomware2.0.exedescription ioc Process File created C:\Users\Admin\Downloads\desktop.ini Rasomware2.0.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
Rasomware2.0.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\Desktop\Wallpaper Rasomware2.0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Rasomware2.0.exepid Process 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe 1964 Rasomware2.0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Rasomware2.0.exedescription pid Process Token: SeDebugPrivilege 1964 Rasomware2.0.exe