Analysis
-
max time kernel
65s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-06-2022 11:33
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
2.exe
-
Size
300KB
-
MD5
73616cce2df45725fa6f3bfab015d667
-
SHA1
4a262fd65081c252a2d0ecbb3daaff9f7f5ff162
-
SHA256
91ad37aca29eb3cc4f5b84cd5128e4f881f9b1e6d91a8c72475a4179e0acebe6
-
SHA512
fc1e599f268b73ba6cdb1629d560533f886aa8f9d503128bc35a5fa3b9c9dba4042d7c46551cdd33792cfe8919259216c42031772b322f65cbfb66548a7cbcfd
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RevokeDisconnect.png => C:\Users\Admin\Pictures\RevokeDisconnect.png.nigger 2.exe File renamed C:\Users\Admin\Pictures\ExpandAssert.tif => C:\Users\Admin\Pictures\ExpandAssert.tif.nigger 2.exe File renamed C:\Users\Admin\Pictures\DisconnectStep.crw => C:\Users\Admin\Pictures\DisconnectStep.crw.nigger 2.exe File renamed C:\Users\Admin\Pictures\BackupHide.png => C:\Users\Admin\Pictures\BackupHide.png.nigger 2.exe File renamed C:\Users\Admin\Pictures\DisconnectOut.crw => C:\Users\Admin\Pictures\DisconnectOut.crw.nigger 2.exe File renamed C:\Users\Admin\Pictures\EditPop.raw => C:\Users\Admin\Pictures\EditPop.raw.nigger 2.exe File renamed C:\Users\Admin\Pictures\StepDisconnect.png => C:\Users\Admin\Pictures\StepDisconnect.png.nigger 2.exe File opened for modification C:\Users\Admin\Pictures\UndoLimit.tiff 2.exe File renamed C:\Users\Admin\Pictures\CompareRestart.raw => C:\Users\Admin\Pictures\CompareRestart.raw.nigger 2.exe File renamed C:\Users\Admin\Pictures\CompareExit.crw => C:\Users\Admin\Pictures\CompareExit.crw.nigger 2.exe File renamed C:\Users\Admin\Pictures\ConvertReceive.png => C:\Users\Admin\Pictures\ConvertReceive.png.nigger 2.exe File renamed C:\Users\Admin\Pictures\DisconnectFormat.raw => C:\Users\Admin\Pictures\DisconnectFormat.raw.nigger 2.exe File renamed C:\Users\Admin\Pictures\TestSend.crw => C:\Users\Admin\Pictures\TestSend.crw.nigger 2.exe File renamed C:\Users\Admin\Pictures\UndoLimit.tiff => C:\Users\Admin\Pictures\UndoLimit.tiff.nigger 2.exe File renamed C:\Users\Admin\Pictures\AssertJoin.raw => C:\Users\Admin\Pictures\AssertJoin.raw.nigger 2.exe -
Drops desktop.ini file(s) 38 IoCs
description ioc Process File created C:\Users\Admin\Saved Games\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2.exe File created C:\Users\Public\Music\Sample Music\desktop.ini 2.exe File created C:\Users\Admin\Downloads\desktop.ini 2.exe File created C:\Users\Admin\Links\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2.exe File created C:\Users\Public\Pictures\desktop.ini 2.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2.exe File created C:\Users\Public\Desktop\desktop.ini 2.exe File created C:\Users\Public\Documents\desktop.ini 2.exe File created C:\Users\Admin\Desktop\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2.exe File created C:\Users\Public\Recorded TV\desktop.ini 2.exe File created C:\Users\Public\Videos\desktop.ini 2.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini 2.exe File created C:\Users\Admin\Videos\desktop.ini 2.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2.exe File created C:\Users\Admin\Documents\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini 2.exe File created C:\Users\Public\Music\desktop.ini 2.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini 2.exe File created C:\Users\Public\desktop.ini 2.exe File created C:\Users\Public\Downloads\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2.exe File created C:\Users\Admin\Pictures\desktop.ini 2.exe File created C:\Users\Admin\Searches\desktop.ini 2.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 2.exe File created C:\Users\Admin\Music\desktop.ini 2.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2.exe File created C:\Users\Public\Libraries\desktop.ini 2.exe File created C:\Users\Admin\Contacts\desktop.ini 2.exe File created C:\Users\Admin\Favorites\desktop.ini 2.exe