Resubmissions
06-09-2023 21:36
230906-1fv22scb33 1003-09-2023 10:45
230903-mtgjxshc8w 1003-09-2023 10:42
230903-mrwaashf43 1003-09-2023 10:39
230903-mqa8qshf26 1003-09-2023 10:34
230903-mmglcahc3s 1003-09-2023 10:34
230903-mmdvfshe84 1003-09-2023 10:32
230903-mk4yvshe79 1003-09-2023 10:31
230903-mkwbqahe76 103-09-2023 10:31
230903-mkswlahb9z 1003-09-2023 10:31
230903-mkp5pshe75 10General
-
Target
92.exe
-
Size
1.3MB
-
Sample
230903-mkswlahb9z
-
MD5
7defc0b43aa2ad389575df2419b7909b
-
SHA1
cf0dd52331ce203c723f7be32bd91d7cfb34a988
-
SHA256
dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
-
SHA512
9291bc529ce05bc4d0f0e464e008023ca8d310beeca0cbf47b21239423607f5944ed446d9e99537c49cf637a1aed3b55a96277f327bc4d8eb8908b400d8c2573
-
SSDEEP
12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS
Static task
static1
Behavioral task
behavioral1
Sample
92.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
C:\Users\How To Restore Your Files.txt
http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/f6e2d5b5-775a-4cca-a4d2-44d6891c3e42/
https://www.binance.com/en/how-to-buy/bitcoin
Targets
-
-
Target
92.exe
-
Size
1.3MB
-
MD5
7defc0b43aa2ad389575df2419b7909b
-
SHA1
cf0dd52331ce203c723f7be32bd91d7cfb34a988
-
SHA256
dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
-
SHA512
9291bc529ce05bc4d0f0e464e008023ca8d310beeca0cbf47b21239423607f5944ed446d9e99537c49cf637a1aed3b55a96277f327bc4d8eb8908b400d8c2573
-
SSDEEP
12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS
Score10/10-
Renames multiple (160) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-