General
-
Target
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
-
Size
53KB
-
Sample
240207-rf4vhshdh3
-
MD5
22ff4b883468f0b2b21b2c50d5ca5bd9
-
SHA1
e34f09cf8f1416ab4611a6a18ff99281fad93c70
-
SHA256
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893
-
SHA512
9b37dff34d3ceca993bebda8e6d3f4f4a361af65ec6bdde4be54021be2dc48c176aa0b0ef2bae8433ca2957d5e3c28fe448465c3f816a5ee36a5d395bd8f4405
-
SSDEEP
1536:oWOeytM3alnawrRIwxVSHMweio36l990:oWOey23alnaEIN/W6lA
Static task
static1
Behavioral task
behavioral1
Sample
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
C:\Users\Public\Music\Sample Music\how_to_back_files.html
Extracted
C:\ProgramData\regid.1991-06.com.microsoft\how_to_back_files.html
Targets
-
-
Target
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893.exe
-
Size
53KB
-
MD5
22ff4b883468f0b2b21b2c50d5ca5bd9
-
SHA1
e34f09cf8f1416ab4611a6a18ff99281fad93c70
-
SHA256
d9135507e8dbcf15a852ec34623ea6b6d633e10032c94f187ef357ba821af893
-
SHA512
9b37dff34d3ceca993bebda8e6d3f4f4a361af65ec6bdde4be54021be2dc48c176aa0b0ef2bae8433ca2957d5e3c28fe448465c3f816a5ee36a5d395bd8f4405
-
SSDEEP
1536:oWOeytM3alnawrRIwxVSHMweio36l990:oWOey23alnaEIN/W6lA
Score10/10-
Renames multiple (7520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-