General
-
Target
fe1b479880db7637fc96d334f216e5e966879a77fac1b85d1fd892a050fbe638.zip
-
Size
45KB
-
Sample
221111-rckx8sfh89
-
MD5
2f428c8bf3d451771638c3fbd464a81a
-
SHA1
61446618ad998e1ff2c4d5296ab0f882e84b319e
-
SHA256
5cff0f6b33e75aec50d970f1b9bf36955229f3f3e031a881646e95502574e978
-
SHA512
9db5b513c433fa8284422e2a72c844dfc1b7c74e3cf6d2c0515c0edc3d9c75ef312fede35393ebe1940d949930d63d62ffcc0fb7182b2fd9455d3b6ea90d136a
-
SSDEEP
768:pij26kKHIWddn6C2MXC3as1NKgi51Wi7qnEiDRRiPGQ/wm4eb1nZsq90PYdEStld:226kYoCJBUKgi5MmidRiPX/whe8kYktB
Static task
static1
Behavioral task
behavioral1
Sample
fe1b479880db7637fc96d334f216e5e966879a77fac1b85d1fd892a050fbe638.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fe1b479880db7637fc96d334f216e5e966879a77fac1b85d1fd892a050fbe638.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\info.hta
https://pidgin.im/download/windows/
Extracted
C:\Users\Admin\Desktop\info.hta
https://pidgin.im/download/windows/
Targets
-
-
Target
fe1b479880db7637fc96d334f216e5e966879a77fac1b85d1fd892a050fbe638.exe
-
Size
70KB
-
MD5
760b7e6a810644e590d70673b6f5e63a
-
SHA1
f60f8a4a666d7c3226f30dddfe69472e1a88b579
-
SHA256
fe1b479880db7637fc96d334f216e5e966879a77fac1b85d1fd892a050fbe638
-
SHA512
8a583dc0e81b4e67053c3175fa29ab7042dbc621cbe7181a3bbfbc7661d6faea3b8be1a1fdcd968fcc388c94394de9858ec537c479c19f9878a831a20ddffd83
-
SSDEEP
1536:cFOPbkyoTwtPto0Rl0DsN9/zLec5oGFACZrqdKaNSEjrZKk:cYPxAwtPtoe/zLaGmCZrqcaYEjrZK
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Modifies Windows Firewall
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-