General
-
Target
f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
-
Size
727KB
-
Sample
221206-y3y14sdb2v
-
MD5
f293ec38bb674e4f56239c2942ae9f01
-
SHA1
78d708e2d1586cc229d1c277173eb00c0fe27c96
-
SHA256
f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa
-
SHA512
09773fcf5a5c97d8494078ae9c443859bbafeb9e8fc92a2211525e59a5cd439cf6b4babaaf958e613e7c9fe2bd7347574bc538b5ef5e8d55c6e7ab9c26d1d035
-
SSDEEP
12288:XoUopVzNYSwOEWtA2OrSxcXB3Q4abIom+2+3NrMv/xjGj9YNCC+NQoEf6Y7kSCd6:XoUopV8ABbhEf4GSwi88yxtK34Y
Static task
static1
Behavioral task
behavioral1
Sample
f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
Resource
win7-20221111-es
Behavioral task
behavioral2
Sample
f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
Resource
win10v2004-20221111-es
Malware Config
Extracted
C:\HOW_TO_DECRYPT.txt
hive
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Extracted
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ae6vytmk.default-release\cache2\entries\HOW_TO_DECRYPT.txt
hive
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
Targets
-
-
Target
f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa.exe
-
Size
727KB
-
MD5
f293ec38bb674e4f56239c2942ae9f01
-
SHA1
78d708e2d1586cc229d1c277173eb00c0fe27c96
-
SHA256
f01f7d18b2e154522abd47cbafe80565b32f4a52103224a9e725656582e63efa
-
SHA512
09773fcf5a5c97d8494078ae9c443859bbafeb9e8fc92a2211525e59a5cd439cf6b4babaaf958e613e7c9fe2bd7347574bc538b5ef5e8d55c6e7ab9c26d1d035
-
SSDEEP
12288:XoUopVzNYSwOEWtA2OrSxcXB3Q4abIom+2+3NrMv/xjGj9YNCC+NQoEf6Y7kSCd6:XoUopV8ABbhEf4GSwi88yxtK34Y
Score10/10-
Modifies boot configuration data using bcdedit
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-