58e5c39d780435909c4988518b3d5d33b3815429c005420cb61e8d3522fb5422

General

Target

5425e988f4427fd1a56dd6616f5b7dc6308fb3ea29babee09242be1cf73c15bb.exe.compressed
Size

99KB
Sample

240128-285bvseaan
MD5

990354fb58448a1a224c3be180e575d9
SHA1

d5f16148af1f50396beac5a56e507ec14eb295c4
SHA256

58e5c39d780435909c4988518b3d5d33b3815429c005420cb61e8d3522fb5422
SHA512

6dc886552d6b938e6fd9379d3c1e5f61b042136e18413208dfe1a8b2de813cf725e82b063b699637b00b04cd55c3ef2cf3e42451926369cc606a42ff7f6073c6
SSDEEP

1536:1Ij4wyUN3HZUR5WnPszr0MBEJVLcZL82ZTBv2caHwaCB284O+cn:cuUJHZU5WPLMBEJlcGE7aHwa

Score

10^/10

ransomware upx

Malware Config

Targets

- Target
  
  5425e988f4427fd1a56dd6616f5b7dc6308fb3ea29babee09242be1cf73c15bb.exe.compressed
- Size
  
  99KB
- MD5
  
  990354fb58448a1a224c3be180e575d9
- SHA1
  
  d5f16148af1f50396beac5a56e507ec14eb295c4
- SHA256
  
  58e5c39d780435909c4988518b3d5d33b3815429c005420cb61e8d3522fb5422
- SHA512
  
  6dc886552d6b938e6fd9379d3c1e5f61b042136e18413208dfe1a8b2de813cf725e82b063b699637b00b04cd55c3ef2cf3e42451926369cc606a42ff7f6073c6
- SSDEEP
  
  1536:1Ij4wyUN3HZUR5WnPszr0MBEJVLcZL82ZTBv2caHwaCB284O+cn:cuUJHZU5WPLMBEJlcGE7aHwa
Score

9^/10

ransomware upx
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Detects executables referencing many IR and analysis tools
- Renames multiple (291) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies boot configuration data using bcdedit
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2