General
-
Target
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2
-
Size
573KB
-
Sample
240224-kgll1afd31
-
MD5
2cda932f5a9dafb0a328d0f9788bd89c
-
SHA1
e27521c7158c6af3aa58f78fcbed64b17c946f70
-
SHA256
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2
-
SHA512
3bcaf2bda26b22b67edcdd5ca357c8e0b7124788dd905c7bf6cacce080ae3f24bd09e1e9260a3ebf3d4d62ea749f7a8b965193a2ebf6db85a563735874511880
-
SSDEEP
12288:BV0qnXKTH2P6rxTcQpXDHgswvodgTAdA:BV0EMm6rxTcQjos
Static task
static1
Behavioral task
behavioral1
Sample
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2.exe
Resource
win10v2004-20240221-en
Malware Config
Targets
-
-
Target
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2
-
Size
573KB
-
MD5
2cda932f5a9dafb0a328d0f9788bd89c
-
SHA1
e27521c7158c6af3aa58f78fcbed64b17c946f70
-
SHA256
2b28270c1675990a2c78b31faab547fb75948dd1c2b22e892377ee5e40abebc2
-
SHA512
3bcaf2bda26b22b67edcdd5ca357c8e0b7124788dd905c7bf6cacce080ae3f24bd09e1e9260a3ebf3d4d62ea749f7a8b965193a2ebf6db85a563735874511880
-
SSDEEP
12288:BV0qnXKTH2P6rxTcQpXDHgswvodgTAdA:BV0EMm6rxTcQjos
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Renames multiple (8527) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-