615014133572a4df7a558c296e6f29fc7a0755f6065af0ac47f41a823b3b2895

General

Target

2bba09d1e43a790c34a960b1dc0339852d994fe857739a7389d52c395a0f0559.exe.compressed
Size

99KB
Sample

240128-2hvdzabfh2
MD5

7894d779048b517e4c508ac2bd26f04a
SHA1

e8c1e8524523b1af7fba4419dc4ab9bd849506f6
SHA256

615014133572a4df7a558c296e6f29fc7a0755f6065af0ac47f41a823b3b2895
SHA512

c174107b7d75ae46b9675562c9ee67dbd074fa5cf98162340d064815cbc98798a26ac2e026756813b83047743f8ca6e2626f1dcd41a68043db009fe079b8bfc7
SSDEEP

1536:jIj4cC6XEL1h8vJPW80Z/mS0ZTEk2PNzBTvLFKb1sWDYwN1UA6hA37n:qJa1iQMTEk2PNzOsnwd6hA

Score

10^/10

ransomware upx

Malware Config

Targets

- Target
  
  2bba09d1e43a790c34a960b1dc0339852d994fe857739a7389d52c395a0f0559.exe.compressed
- Size
  
  99KB
- MD5
  
  7894d779048b517e4c508ac2bd26f04a
- SHA1
  
  e8c1e8524523b1af7fba4419dc4ab9bd849506f6
- SHA256
  
  615014133572a4df7a558c296e6f29fc7a0755f6065af0ac47f41a823b3b2895
- SHA512
  
  c174107b7d75ae46b9675562c9ee67dbd074fa5cf98162340d064815cbc98798a26ac2e026756813b83047743f8ca6e2626f1dcd41a68043db009fe079b8bfc7
- SSDEEP
  
  1536:jIj4cC6XEL1h8vJPW80Z/mS0ZTEk2PNzBTvLFKb1sWDYwN1UA6hA37n:qJa1iQMTEk2PNzOsnwd6hA
Score

9^/10

ransomware upx
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Detects executables referencing many IR and analysis tools
- Renames multiple (301) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies boot configuration data using bcdedit
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2