StartW
startW
Behavioral task
behavioral1
Sample
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked.dll
Resource
win10v2004-20230220-en
Target
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e_unpacked
Size
68KB
MD5
49d8bd6dcaa501ca742bd686c161e5e0
SHA1
9acdd840615e4f4cd37f50e66b7bb7bb222d4fca
SHA256
6f9bed90c1d6df1c7b259f832130b5fef5e0d0c9dc6c2564dad53dc0ca30bb0e
SHA512
26d480f4480c99093859d3bb697dacc69c7165fc75603c717db6c1d0959463d7d9a33a32d3e1ec5360b0d031db4b77734f0ebcbf2bafb46b7390e1967d8a7b12
SSDEEP
768:PjzkUtPX7y4J6IjDcGopwx2P+9n+PLcHosFBLtuBDUaDO2y:0aXG4HtEPina7AdY3y
Processes:
resource | yara_rule |
---|---|
sample | RANSOM_mountlocker |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
ReleaseSemaphore
WaitForSingleObject
GetTickCount64
SetEvent
CreateThread
CreateSemaphoreA
CreateEventA
DeviceIoControl
SetFileAttributesW
lstrcmpiW
TerminateThread
ResetEvent
ReadFile
GetFileSizeEx
TlsSetValue
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
TlsGetValue
GetDriveTypeW
GetCommandLineW
ExitProcess
QueryPerformanceCounter
lstrlenA
TlsAlloc
GetComputerNameA
TerminateProcess
OpenProcess
lstrcmpiA
GetModuleFileNameW
GetTempPathW
CreateProcessW
GetSystemInfo
GetComputerNameW
GlobalMemoryStatus
DeleteFileW
CopyFileW
GetConsoleScreenBufferInfo
EnterCriticalSection
GetStdHandle
LeaveCriticalSection
InitializeCriticalSection
WriteConsoleW
DeleteCriticalSection
SetConsoleCursorPosition
AllocConsole
QueryPerformanceFrequency
GetTickCount
Sleep
GetCurrentProcess
WideCharToMultiByte
GetCurrentProcessId
HeapReAlloc
SetLastError
CloseHandle
CreateFileW
WriteFile
GetLastError
FindClose
FindNextFileW
HeapFree
FindFirstFileW
GetVolumeInformationW
lstrcpyW
GetProcessHeap
HeapAlloc
lstrcatW
lstrlenW
SetErrorMode
RtlVirtualUnwind
ord9
CommandLineToArgvW
ord680
WNetCloseEnum
WNetEnumResourceW
WNetAddConnection2W
WNetOpenEnumW
WNetCancelConnection2W
NetGetDCName
NetApiBufferFree
NetShareEnum
NetGetJoinInformation
SysFreeString
SysAllocString
wsprintfW
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
memcpy
feof
_vsnwprintf
_getch
fgetws
_wfopen
fclose
memset
CryptDestroyKey
OpenServiceA
QueryServiceStatusEx
StartServiceW
ControlService
DeleteService
OpenSCManagerA
OpenSCManagerW
CryptAcquireContextW
CreateServiceW
EnumServicesStatusA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidW
GetUserNameW
CloseServiceHandle
CryptReleaseContext
CryptImportKey
CryptEncrypt
RtlGetNativeSystemInformation
ZwQuerySystemInformation
RtlGetVersion
StrCmpIW
StrStrIA
StrCmpNIW
SHRegSetUSValueW
StrStrIW
StrChrW
StartW
startW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ