General
-
Target
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6
-
Size
873KB
-
Sample
220704-hcw6tsfaen
-
MD5
827ce17c53de507c34b000e73c103de7
-
SHA1
c15011e565af3b2845eb9707132d3187fb93a54e
-
SHA256
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6
-
SHA512
e2f54c654a86718e456c18151653626fcb3a361c7717281a6eff47fb68ac0df673926edc4f459b5b7e2e4aaab9e0f644250d48475838b74c488e34e2bbeed766
Static task
static1
Behavioral task
behavioral1
Sample
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\How To Restore Your Files.txt
Targets
-
-
Target
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6
-
Size
873KB
-
MD5
827ce17c53de507c34b000e73c103de7
-
SHA1
c15011e565af3b2845eb9707132d3187fb93a54e
-
SHA256
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6
-
SHA512
e2f54c654a86718e456c18151653626fcb3a361c7717281a6eff47fb68ac0df673926edc4f459b5b7e2e4aaab9e0f644250d48475838b74c488e34e2bbeed766
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-