General
-
Target
cd89fd5bf3049fad64718c190ae014b4c9c0d141e3550d63008c1c5c71d50bd7
-
Size
55KB
-
Sample
221103-jgk5ssffh6
-
MD5
fd0ef924c1edc067cd2298024a7057b0
-
SHA1
0a32d7600869f37f0fbe2a5c996cda5111d4a4d1
-
SHA256
cd89fd5bf3049fad64718c190ae014b4c9c0d141e3550d63008c1c5c71d50bd7
-
SHA512
275efb2d22ceaed29c4c4563782f648663ea752a6b08d4472ba12d29dc76c57b2120c3a5984d08f5a0ebdd3abf68e6ea8af1325ff9eb24830c43c8c489ad44c0
-
SSDEEP
1536:HNeRBl5PT/rx1mzwRMSTdLpJ47kmvBMRM:HQRrmzwR5JWk2+
Static task
static1
Behavioral task
behavioral1
Sample
cd89fd5bf3049fad64718c190ae014b4c9c0d141e3550d63008c1c5c71d50bd7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cd89fd5bf3049fad64718c190ae014b4c9c0d141e3550d63008c1c5c71d50bd7.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
cd89fd5bf3049fad64718c190ae014b4c9c0d141e3550d63008c1c5c71d50bd7
-
Size
55KB
-
MD5
fd0ef924c1edc067cd2298024a7057b0
-
SHA1
0a32d7600869f37f0fbe2a5c996cda5111d4a4d1
-
SHA256
cd89fd5bf3049fad64718c190ae014b4c9c0d141e3550d63008c1c5c71d50bd7
-
SHA512
275efb2d22ceaed29c4c4563782f648663ea752a6b08d4472ba12d29dc76c57b2120c3a5984d08f5a0ebdd3abf68e6ea8af1325ff9eb24830c43c8c489ad44c0
-
SSDEEP
1536:HNeRBl5PT/rx1mzwRMSTdLpJ47kmvBMRM:HQRrmzwR5JWk2+
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies boot configuration data using bcdedit
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-