General
-
Target
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
-
Size
53KB
-
Sample
230225-fs5f2aca7s
-
MD5
5efa19dc204e46e8d8c57482f80e7a40
-
SHA1
5c83b3ddc8417fe64e0bbd3495445ddcee52e35e
-
SHA256
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f
-
SHA512
0cdf4a1263b9a341240acea245155f0afbaac864eccd1d9623a9a152a9287e8a65cd62f12804d5a1293c9d960a4958c2aa05a720f35d42699fec5d4ac0accfc1
-
SSDEEP
768:FKcvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5YW:F9eytM3alnawrRIwxVSHMweio3+
Static task
static1
Behavioral task
behavioral1
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
Resource
win10v2004-20230221-en
Malware Config
Extracted
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Extracted
C:\ProgramData\regid.1991-06.com.microsoft\how_to_back_files.html
Targets
-
-
Target
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f.exe
-
Size
53KB
-
MD5
5efa19dc204e46e8d8c57482f80e7a40
-
SHA1
5c83b3ddc8417fe64e0bbd3495445ddcee52e35e
-
SHA256
fd71b1ab3e3823ccd88c0f406c30c4386074c36e1c0432e13121550cd655098f
-
SHA512
0cdf4a1263b9a341240acea245155f0afbaac864eccd1d9623a9a152a9287e8a65cd62f12804d5a1293c9d960a4958c2aa05a720f35d42699fec5d4ac0accfc1
-
SSDEEP
768:FKcvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5YW:F9eytM3alnawrRIwxVSHMweio3+
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Adds Run key to start application
-