General
-
Target
HEUR-Trojan-Ransom.Win32.Generic-7e3fb87027b84b39e369efde5f180e6d0bcfda15489b4387a6e0737943556de6.exe
-
Size
326KB
-
Sample
220925-e6hnradcd4
-
MD5
69324ffa4e40aa8c63fd9b27848aa371
-
SHA1
f608c5838f173558d7851e1517cf4ab722b13e26
-
SHA256
7e3fb87027b84b39e369efde5f180e6d0bcfda15489b4387a6e0737943556de6
-
SHA512
d51b8da50273967bcc91e19ac21db0adc2d4870a10a60ed2f621cd7ddb9d2152424e7be95aacac743f75c607b9d445ea8f1172c9ab2b4b7af477f4f7c178b4db
-
SSDEEP
6144:WM9uJiJ1mEjuSW3C2oCmhqoeBsGciYOf+ZLswYjUtMTO:WMSiS9SW35dmhqoeBsGJGKlO
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.Win32.Generic-7e3fb87027b84b39e369efde5f180e6d0bcfda15489b4387a6e0737943556de6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.Win32.Generic-7e3fb87027b84b39e369efde5f180e6d0bcfda15489b4387a6e0737943556de6.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
HEUR-Trojan-Ransom.Win32.Generic-7e3fb87027b84b39e369efde5f180e6d0bcfda15489b4387a6e0737943556de6.exe
-
Size
326KB
-
MD5
69324ffa4e40aa8c63fd9b27848aa371
-
SHA1
f608c5838f173558d7851e1517cf4ab722b13e26
-
SHA256
7e3fb87027b84b39e369efde5f180e6d0bcfda15489b4387a6e0737943556de6
-
SHA512
d51b8da50273967bcc91e19ac21db0adc2d4870a10a60ed2f621cd7ddb9d2152424e7be95aacac743f75c607b9d445ea8f1172c9ab2b4b7af477f4f7c178b4db
-
SSDEEP
6144:WM9uJiJ1mEjuSW3C2oCmhqoeBsGciYOf+ZLswYjUtMTO:WMSiS9SW35dmhqoeBsGJGKlO
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-