General
-
Target
74f3534ec10a5a34cab4aa07b77c148538340dba599bcb8b6d1fde298d0d9e21
-
Size
980KB
-
Sample
220516-b8es4ahbe2
-
MD5
e1910ce7fa51b3d99c1664c632949cdd
-
SHA1
4067b985c86512cb46ffd36605a82e3d3f852d16
-
SHA256
74f3534ec10a5a34cab4aa07b77c148538340dba599bcb8b6d1fde298d0d9e21
-
SHA512
f634e1ca2e4399c6b4c4d805757d8b7283a5aa2bdc8d8528345fc88c2445c2f67ba2411601857e13e2c0985228f0c182f5b600dbf1b1c55c1c6437f387ec0972
Static task
static1
Behavioral task
behavioral1
Sample
74f3534ec10a5a34cab4aa07b77c148538340dba599bcb8b6d1fde298d0d9e21.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
74f3534ec10a5a34cab4aa07b77c148538340dba599bcb8b6d1fde298d0d9e21.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\README1.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README2.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README3.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README4.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README5.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README6.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README7.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README8.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README9.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Extracted
C:\README10.txt
http://cryptsen7fo43rr6.onion/
http://cryptsen7fo43rr6.onion.to/
http://cryptsen7fo43rr6.onion.cab/
Targets
-
-
Target
74f3534ec10a5a34cab4aa07b77c148538340dba599bcb8b6d1fde298d0d9e21
-
Size
980KB
-
MD5
e1910ce7fa51b3d99c1664c632949cdd
-
SHA1
4067b985c86512cb46ffd36605a82e3d3f852d16
-
SHA256
74f3534ec10a5a34cab4aa07b77c148538340dba599bcb8b6d1fde298d0d9e21
-
SHA512
f634e1ca2e4399c6b4c4d805757d8b7283a5aa2bdc8d8528345fc88c2445c2f67ba2411601857e13e2c0985228f0c182f5b600dbf1b1c55c1c6437f387ec0972
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-