Static task
static1
Behavioral task
behavioral1
Sample
15ace64f455ce0773a2eab67e8c7e7f5577d48ccde0b8a50c7e6c472d7e5c2fc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
15ace64f455ce0773a2eab67e8c7e7f5577d48ccde0b8a50c7e6c472d7e5c2fc.exe
Resource
win10v2004-20240226-en
General
-
Target
15ace64f455ce0773a2eab67e8c7e7f5577d48ccde0b8a50c7e6c472d7e5c2fc.sample
-
Size
156KB
-
MD5
f81d5cdf6725d7f37281fafc282609bb
-
SHA1
0382a0693682779526fac5639f0f8555fb63848c
-
SHA256
15ace64f455ce0773a2eab67e8c7e7f5577d48ccde0b8a50c7e6c472d7e5c2fc
-
SHA512
b54ab698651681be90ce3254cf974104b9dd6983bbd8f37271c05a1747abaab0dcd79f8e32198ba0da59516613675a2b484fc6dc8f1b91d92b71ef6d82676c88
-
SSDEEP
3072:HiDWuzrgr53Xatvh1r+O0munQWOvu380nuaBu4G18pmF:UWyrg13XaflF0CWOvuPZ1+8oF
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15ace64f455ce0773a2eab67e8c7e7f5577d48ccde0b8a50c7e6c472d7e5c2fc.sample
Files
-
15ace64f455ce0773a2eab67e8c7e7f5577d48ccde0b8a50c7e6c472d7e5c2fc.sample.exe windows:5 windows x86 arch:x86
1fd122b9ca94acba6fc7f91070658c1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
GetConsoleWindow
SetConsoleCursorPosition
AllocConsole
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindFirstVolumeW
FindNextFileW
GetFinalPathNameByHandleW
WaitForMultipleObjects
SetThreadPriority
GetQueuedCompletionStatus
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
ExitProcess
SetFilePointerEx
LocalFree
MoveFileExW
FindVolumeClose
GetCurrentProcessId
SetThreadExecutionState
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
HeapCreate
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
SetStdHandle
GetProcAddress
WriteConsoleW
ScrollConsoleScreenBufferW
GetNativeSystemInfo
GetLastError
Sleep
OpenProcess
ReleaseMutex
WaitForSingleObject
CreateMutexW
SetProcessShutdownParameters
GetStdHandle
TerminateProcess
GetCurrentProcess
SetPriorityClass
GetConsoleScreenBufferInfo
GetCommandLineW
ReadFile
DeleteCriticalSection
GetLocalTime
CloseHandle
lstrcatW
CreateFileW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
SetVolumeMountPointW
LCMapStringW
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetFileType
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetACP
RaiseException
user32
wsprintfA
wsprintfW
ShowWindow
advapi32
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shell32
SHEmptyRecycleBinW
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantClear
SysAllocString
VariantInit
rstrtmgr
RmStartSession
RmGetList
RmRegisterResources
RmEndSession
shlwapi
PathRemoveFileSpecW
PathFindExtensionW
StrStrIW
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ