Overview
overview
10Static
static
3Ransomware.7ev3n.exe
windows10-2004-x64
Ransomware...it.exe
windows10-2004-x64
10MalwareCol...le.zip
windows10-2004-x64
1MalwareCol....0.zip
windows10-2004-x64
1MalwareCol...pe.zip
windows10-2004-x64
1MalwareCol...ot.zip
windows10-2004-x64
1MalwareCol...fe.zip
windows10-2004-x64
1Resubmissions
24-02-2024 15:44
240224-s6pzqafh53 1024-02-2024 14:06
240224-relmjsdh45 1024-02-2024 11:48
240224-nyvssabe4w 3Analysis
-
max time kernel
217s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 15:44
Static task
static1
Behavioral task
behavioral1
Sample
Ransomware.7ev3n.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral2
Sample
Ransomware.BadRabbit.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
MalwareCollection-master/Trojan/Trojan.DesktopPuzzle.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral4
Sample
MalwareCollection-master/Trojan/Trojan.MEMZ-4.0.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
MalwareCollection-master/Trojan/Trojan.NoEscape.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral6
Sample
MalwareCollection-master/Trojan/Trojan.YouAreAnIdiot.zip
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
MalwareCollection-master/Worm/Email-Worm/Email-Worm.NakedWife.zip
Resource
win10v2004-20240221-en
General
-
Target
MalwareCollection-master/Trojan/Trojan.DesktopPuzzle.zip
-
Size
121KB
-
MD5
117e52fe771b57a0f4ff1b60bb11156d
-
SHA1
85683e612e0d8cd948b5cbc3619ee906f87e232f
-
SHA256
c1489ac00723abe5af6705e23bc70a6dd23ba5c98d080852b07a284727a2811f
-
SHA512
ea2503b7c1c6b0bd5c34aaf23517d93510e69b364113c2d7aeaa4e48ffc25d2d953d7e25af4fa8ada528a6969aa72d5471a4f4d2eab4117eb0583eaf4af62e31
-
SSDEEP
3072:xTFBtKMERzQikryOzbszDjv7SvFx2AJZxicweHUAxy:xTpTERzQjrHyDjT06AJizpt
Malware Config
Signatures
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MalwareCollection-master\Trojan\Trojan.DesktopPuzzle.zip1⤵PID:3640
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1664
Network
-
Remote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.173.189.20.in-addr.arpaIN PTRResponse
-
71 B 157 B 1 1
DNS Request
67.31.126.40.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
173.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
9.173.189.20.in-addr.arpa