Overview
overview
10Static
static
3cerber.exe
windows10-2004-x64
10cryptowall.exe
windows10-2004-x64
3jigsaw.exe
windows10-2004-x64
10Locky.exe
windows10-2004-x64
10131.exe
windows10-2004-x64
1Matsnu-MBR...3 .exe
windows10-2004-x64
3027cc450ef...d9.dll
windows10-2004-x64
10027cc450ef...ju.dll
windows10-2004-x64
10myguy.hta
windows10-2004-x64
3svchost.exe
windows10-2004-x64
7Ransomware...oad.sh
windows10-2004-x64
3Ransomware...est.py
windows10-2004-x64
3Ransomware...st2.py
windows10-2004-x64
3Ransomware...rna.py
windows10-2004-x64
3Analysis
-
max time kernel
1740s -
max time network
1172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 15:25
Static task
static1
Behavioral task
behavioral1
Sample
cerber.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral2
Sample
cryptowall.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
jigsaw.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral4
Sample
Locky.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral5
Sample
131.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral6
Sample
Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral7
Sample
027cc450ef5f8c5f653329641ec1fed9.dll
Resource
win10v2004-20231130-en
Behavioral task
behavioral8
Sample
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
myguy.hta
Resource
win10v2004-20231127-en
Behavioral task
behavioral10
Sample
svchost.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral11
Sample
Ransomware-master/etc/load.sh
Resource
win10v2004-20231127-en
Behavioral task
behavioral12
Sample
Ransomware-master/test.py
Resource
win10v2004-20231127-en
Behavioral task
behavioral13
Sample
Ransomware-master/test2.py
Resource
win10v2004-20231130-en
Behavioral task
behavioral14
Sample
Ransomware-master/warna.py
Resource
win10v2004-20231130-en
General
-
Target
Ransomware-master/test2.py
-
Size
554B
-
MD5
dc42f74575c40fc6c90d73b747df6803
-
SHA1
ff5d98b1f959810719299c5fb0042436634b1999
-
SHA256
d1f9f5e30ac4d8d5771af930b15a51fb040cb1a2b84c7b7feeebb7e4d5fdc1bb
-
SHA512
d4a311676aa16d11f678eaf32e5ee4c18ba2f3beab0d494e09ae6a8214575d5178b9de7126131ad0d5da909594a4e0dbbb791ebed62550b9080cf2a8fb78bb9e
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4428 OpenWith.exe