General
-
Target
7669536131.zip
-
Size
1.4MB
-
Sample
220705-lcrg5afgbn
-
MD5
ffa68ff61e7bbd1f7f007ed198546175
-
SHA1
38519bbdf82a61b2b011ae62fa31a18f8166bced
-
SHA256
e1311de1d3979812f422ac4395483864c36adfd8ccaebdfec11fbd3630165111
-
SHA512
5b1f5690b5b5a9f26802e83c48e62ead3875ea152b4ebcf6841edcee178a39b3f4c558bbed2f41838cdec275395bff1f2aec9f52efa72ae86dae69530cae82a9
Static task
static1
Behavioral task
behavioral1
Sample
b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\How To Restore Your Files.txt
Extracted
C:\How To Restore Your Files.txt
Targets
-
-
Target
b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9
-
Size
811KB
-
MD5
7d710e304c5d5d1febe8c0e1bf14615a
-
SHA1
34d813aedb66d14ece1276f8ee61a568546c8dbe
-
SHA256
b0a010e5a9b353a11fb664501de91fc47878d89bf97cb57bc03428c7a45981b9
-
SHA512
6ece233063306b29c3abf1d4449a9cf172a77f44f2f2ceb48ea23161de57aa795c720d263ea9d6964c7ec5756024e21a6464cabd47c6a8ca9e49263b2b339bab
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3
-
Size
875KB
-
MD5
f1dd01a9e4b959e569250354d74e0423
-
SHA1
7e2e524fd33261449571f1334868b17ef46e550d
-
SHA256
cf3bdf0f8ea4c8ece5f5a76524ab4c81fea6c3a1715b5a86b3ad4d397fca76f3
-
SHA512
d878f63456abdc4a67abd0bd208faf1e77c6baf470f84afa345c6c013f519fc4cff10ae5b3cd700e5fabf11fee3c7e1b357d81e89f7c8c09ce9ef53c99d76202
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-