73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25

Analysis

max time kernel
91s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 11:13

Target
73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
Size 326KB
Sample221012-nbr4daddam
SHA256 73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25
MD5 f8533019841821eabdaec327f39ac2af
SHA1 def6b8c24e7bc476d1260499f51885bd7fb3fd69
SHA512 7b430cd802802d22ee5423d3dae92ee87fef18698fae43125a0d8b5c6c5740f93af076981345ad21d0e0bfacba08dd2cba02002dea3c8f4d2a5d34e637cdc3c9
SSDEEP 3072:V+biqYv27xcRI7KmR3XatDLJbfdI7o7X1DfrNo9e/JsY9fK9Hc:V+bDO2NcWR3XwlbbX9rx9y
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

ransomware

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ExitUnprotect.png.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
File opened for modification	C:\Users\Admin\Pictures\RestartUndo.raw.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
File opened for modification	C:\Users\Admin\Pictures\ResetWrite.crw.MafiaWare666	73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe

C:\Users\Admin\AppData\Local\Temp\73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe
"C:\Users\Admin\AppData\Local\Temp\73d8e7baa073997d060ecf826b533263cf857a89b36a5fea809b7dbfc70b2d25.exe"
1⤵
- Modifies extensions of user files
PID:1320

memory/1320-132-0x0000028405890000-0x00000284058E8000-memory.dmp

Download

memory/1320-133-0x00007FFC1C7B0000-0x00007FFC1D271000-memory.dmp

Download

memory/1320-134-0x00007FFC1C7B0000-0x00007FFC1D271000-memory.dmp

Download