General
-
Target
dsygrqdf.exe
-
Size
192KB
-
Sample
230516-z9t66sbg5x
-
MD5
b96329e44c5b6261eda4786221c1ea2c
-
SHA1
ae109ee47381826501f6eae35c9f9b4d1ecdcd25
-
SHA256
69df825ccb14f20f8e25b73542611d17313cb03e2e49ab44f1ee9d26a124a98a
-
SHA512
fd31a0fd685ffc9ec56a6e53c4c67a8fba75cc50e061922f6f86dc81fdba2159d5171885bde4504a41922a08bf2df6718ac4212df021f1a38436691300667e3d
-
SSDEEP
3072:hzqT24OB8Xjr0N5rlgQB836w8VWbikeNfGmGooGB+DMpKlGQT+3W2WWj:hzqhO2Twrd/WmDNXoG+MolGJ5fj
Static task
static1
Behavioral task
behavioral1
Sample
dsygrqdf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dsygrqdf.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Analysis Services\WE CAN RECOVER YOUR DATA.TXT
https://getsession.org
Targets
-
-
Target
dsygrqdf.exe
-
Size
192KB
-
MD5
b96329e44c5b6261eda4786221c1ea2c
-
SHA1
ae109ee47381826501f6eae35c9f9b4d1ecdcd25
-
SHA256
69df825ccb14f20f8e25b73542611d17313cb03e2e49ab44f1ee9d26a124a98a
-
SHA512
fd31a0fd685ffc9ec56a6e53c4c67a8fba75cc50e061922f6f86dc81fdba2159d5171885bde4504a41922a08bf2df6718ac4212df021f1a38436691300667e3d
-
SSDEEP
3072:hzqT24OB8Xjr0N5rlgQB836w8VWbikeNfGmGooGB+DMpKlGQT+3W2WWj:hzqhO2Twrd/WmDNXoG+MolGJ5fj
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-