General
-
Target
HEUR-Trojan-Ransom.Win32.Generic-43bb3267bbce92106b2699d236d66c4fdd549446b99110faf55d92263ac5d389.exe
-
Size
61KB
-
Sample
220925-e51g6seeer
-
MD5
e680f507b13f1d68df733221e18169cf
-
SHA1
024d22d9a084ac576239590ac4b9c61ea9fc259a
-
SHA256
43bb3267bbce92106b2699d236d66c4fdd549446b99110faf55d92263ac5d389
-
SHA512
2e9017dc5c3537123c443922b25881d328630822744b1111da8655b4c03bf670c2657822e718f65fd8bd62eded931f55cf0ac5ddefe9644d2f6dbee41519477d
-
SSDEEP
768:kKsMqCXfVcWlQM9ZkiANIUL1YLDwUzc80gmq3oP/oDL:kKseSM9ZkiAPOr/0O8/oP
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.Win32.Generic-43bb3267bbce92106b2699d236d66c4fdd549446b99110faf55d92263ac5d389.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.Win32.Generic-43bb3267bbce92106b2699d236d66c4fdd549446b99110faf55d92263ac5d389.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
HEUR-Trojan-Ransom.Win32.Generic-43bb3267bbce92106b2699d236d66c4fdd549446b99110faf55d92263ac5d389.exe
-
Size
61KB
-
MD5
e680f507b13f1d68df733221e18169cf
-
SHA1
024d22d9a084ac576239590ac4b9c61ea9fc259a
-
SHA256
43bb3267bbce92106b2699d236d66c4fdd549446b99110faf55d92263ac5d389
-
SHA512
2e9017dc5c3537123c443922b25881d328630822744b1111da8655b4c03bf670c2657822e718f65fd8bd62eded931f55cf0ac5ddefe9644d2f6dbee41519477d
-
SSDEEP
768:kKsMqCXfVcWlQM9ZkiANIUL1YLDwUzc80gmq3oP/oDL:kKseSM9ZkiAPOr/0O8/oP
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-