Static task
static1
Behavioral task
behavioral1
Sample
a6406d385b8dc274bb5445079925e7c2ac4a650dc6e8531e8ee80af6c1837cef.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a6406d385b8dc274bb5445079925e7c2ac4a650dc6e8531e8ee80af6c1837cef.exe
Resource
win10v2004-20240226-en
General
-
Target
a6406d385b8dc274bb5445079925e7c2ac4a650dc6e8531e8ee80af6c1837cef.sample
-
Size
155KB
-
MD5
06e68470c6391a88a03b806bc250a902
-
SHA1
be177c6e0acfe9643ff87a1c31b564a59fc8024e
-
SHA256
a6406d385b8dc274bb5445079925e7c2ac4a650dc6e8531e8ee80af6c1837cef
-
SHA512
72071e251334ceb3bf922b7530c3e6c74b276106cf48760580fc466a45374d9c0fb9f82bab9e33f295ae2b4905a052c48b247db175f187a6fa8a0bf96a129b7f
-
SSDEEP
3072:XsrJ79XAsFvX/Zv7asJusmTq33pGe33tUXWPrYPu46lmz8Iv:gJ79XAKvX/dzIs8qJGe3dNMD60z8W
Malware Config
Signatures
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6406d385b8dc274bb5445079925e7c2ac4a650dc6e8531e8ee80af6c1837cef.sample
Files
-
a6406d385b8dc274bb5445079925e7c2ac4a650dc6e8531e8ee80af6c1837cef.sample.exe windows:5 windows x86 arch:x86
1fd122b9ca94acba6fc7f91070658c1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
GetConsoleWindow
SetConsoleCursorPosition
AllocConsole
GetLogicalDrives
FindFirstFileW
GetFileSizeEx
FindFirstVolumeW
FindNextFileW
GetFinalPathNameByHandleW
WaitForMultipleObjects
SetThreadPriority
GetQueuedCompletionStatus
lstrlenA
FindClose
PostQueuedCompletionStatus
SetFileAttributesW
GetCurrentThread
GetSystemInfo
LoadLibraryW
CreateThread
ExitProcess
SetFilePointerEx
LocalFree
MoveFileExW
FindVolumeClose
GetCurrentProcessId
SetThreadExecutionState
GetVolumePathNamesForVolumeNameW
FindNextVolumeW
CreateIoCompletionPort
GetDriveTypeW
HeapCreate
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
DecodePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
SetStdHandle
GetProcAddress
WriteConsoleW
ScrollConsoleScreenBufferW
GetNativeSystemInfo
GetLastError
Sleep
OpenProcess
ReleaseMutex
WaitForSingleObject
CreateMutexW
SetProcessShutdownParameters
GetStdHandle
TerminateProcess
GetCurrentProcess
SetPriorityClass
GetConsoleScreenBufferInfo
GetCommandLineW
ReadFile
DeleteCriticalSection
GetLocalTime
CloseHandle
lstrcatW
CreateFileW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
WriteFile
EnterCriticalSection
lstrcmpiW
lstrcpyW
lstrlenW
SetVolumeMountPointW
LCMapStringW
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetFileType
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetACP
RaiseException
user32
wsprintfA
wsprintfW
ShowWindow
advapi32
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shell32
SHEmptyRecycleBinW
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ole32
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantClear
SysAllocString
VariantInit
rstrtmgr
RmStartSession
RmGetList
RmRegisterResources
RmEndSession
shlwapi
PathRemoveFileSpecW
PathFindExtensionW
StrStrIW
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ