General
-
Target
d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.zip
-
Size
7KB
-
Sample
230414-zhrxqsdc5z
-
MD5
6a670dd94d94b24a4951dbb546668406
-
SHA1
891252b3b2925d52ddd969bd58b86af9ead15526
-
SHA256
48c0663ebe0499bdf954489b065c48c4568e4a58c4b6b90167c5d68ff0d4ab07
-
SHA512
a25ca5df78d6fe62a92a669ca674fb2f788d847c7b3260698f3e025ef6d29bc1416f414a15667efb313f41cdadf52f6d0165d9402ab1846080f53a6e5d1048a2
-
SSDEEP
192:30X6LliqvVPSZWkgLopCDVvHCdFP+6iG3FvfUl:30X6LcqdPKgLop64FG61vfUl
Static task
static1
Behavioral task
behavioral1
Sample
d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Program Files (x86)\Windows NT\explorer.exe
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.Contact_Data_Recovery.txt
Extracted
C:\Program Files\7-Zip\descript.ion.Contact_Data_Recovery.txt
Targets
-
-
Target
d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f.exe
-
Size
17KB
-
MD5
afd4357f76d04b947920e9831af8ce66
-
SHA1
b7d67cdd306fbff772d82c2f02ba701ba5306d5a
-
SHA256
d2836cbcc2f103c079eb15c5bce0ae62bde57f70bc3f9f268654a564dec8ed8f
-
SHA512
c61b64561d40036f414d0332a7ada1570e2f0313e6aee78f4141dc839f9937c6acb5b6a8259d3cb332282a3c578cc23dbdf70b54e0edb578f55b107890c295be
-
SSDEEP
384:1NuTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zxWKhWqWhUCF:1Nu9CaxEovcm/BCvX7zA
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Modifies WinLogon
-