General
-
Target
2x.7z
-
Size
290KB
-
Sample
220618-npcwlsgeer
-
MD5
395a18db267f747881c812780d732e16
-
SHA1
7e067832c69333d7a6f0da4fda1b73b899377080
-
SHA256
674f6b6d5a273b7fb5931960f58fdd5165b42f9ae3636f15233b8d6b06bceeff
-
SHA512
97bcb8813b4866347dce68b56f0d9369417c6915728227184d6692f6206811c19388341c1828f12636e334f97067f48adab9e1f712fbd3a025e27dd26a6c2389
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\Users\Admin\Desktop\PopSuspend.txt
ryuk
Extracted
C:\Users\Admin\Downloads\ConfirmDisconnect.txt
ryuk
Targets
-
-
Target
1.bin
-
Size
299KB
-
MD5
5995ab21a51618aef0c7aef5b4d82f76
-
SHA1
55da88e2d5dee9134469ddc416b946cd97143c93
-
SHA256
a87536fa66b6840d22b702dd7450f79140e88794fd466ef0320ba3b664964baf
-
SHA512
b6ba33c85899e44a6706a6e2aed756ecff177c15840e4ea715ece45702da31f4aefaa68d560a859456a17d2cc76923049c452a4618c119cbc52d0d4da1126293
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-
-
-
Target
2.bin
-
Size
300KB
-
MD5
73616cce2df45725fa6f3bfab015d667
-
SHA1
4a262fd65081c252a2d0ecbb3daaff9f7f5ff162
-
SHA256
91ad37aca29eb3cc4f5b84cd5128e4f881f9b1e6d91a8c72475a4179e0acebe6
-
SHA512
fc1e599f268b73ba6cdb1629d560533f886aa8f9d503128bc35a5fa3b9c9dba4042d7c46551cdd33792cfe8919259216c42031772b322f65cbfb66548a7cbcfd
Score8/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s)
-