General
-
Target
TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe
-
Size
1.1MB
-
Sample
230901-kmk8esea58
-
MD5
7d71c897223fbc3c0b0ec324e27804e3
-
SHA1
0ee04f020d4f36ac6c5c2fa7667de7ac897dc41e
-
SHA256
b6064f6936f72d1312f40f86f0cb889c6d0477c20f59c6c96c385c6287f701f7
-
SHA512
c3330ee5f293b5cabdcd9fd8da3fa175383ebc8697db9c95ad9a82e6048089ae8a86fde7df9fdc5a8988130b2c73266465f214cdb9b06d7ed6258e85075ec8ec
-
SSDEEP
12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPKouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QKcGRD
Static task
static1
Behavioral task
behavioral1
Sample
TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
C:\Users\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/fb3a1029-b9f9-4b91-86c4-1012f83a6220/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
TmsLA6kdcU8jxKzpMvbUVweTeF5YcR.exe
-
Size
1.1MB
-
MD5
7d71c897223fbc3c0b0ec324e27804e3
-
SHA1
0ee04f020d4f36ac6c5c2fa7667de7ac897dc41e
-
SHA256
b6064f6936f72d1312f40f86f0cb889c6d0477c20f59c6c96c385c6287f701f7
-
SHA512
c3330ee5f293b5cabdcd9fd8da3fa175383ebc8697db9c95ad9a82e6048089ae8a86fde7df9fdc5a8988130b2c73266465f214cdb9b06d7ed6258e85075ec8ec
-
SSDEEP
12288:RBVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPKouMA+nkGGCp+D:CTcCG0447AMVgfdnTClVm4QKcGRD
Score10/10-
Renames multiple (190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-