General
-
Target
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
-
Size
151KB
-
Sample
240314-et2absab8v
-
MD5
033b58faabb72627b43d7048448e635a
-
SHA1
f29a804d3d98681e556f95351b0ed9c74770e903
-
SHA256
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
-
SHA512
bbee4304bea99f4df82339beff68999f6d544fe021876e6dd2572c3ac4184f3ecddc061e442c20b9a3a4b8b439afcd62f9ebfa6018d7c0b6f51da18658b2f92b
-
SSDEEP
3072:rqJogYkcSNm9V7DOYvvNzONDmi3iluo9dhg+rxaeP8MT:rq2kc4m9tDptOckiYo9d6mYek
Behavioral task
behavioral1
Sample
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\cfNIlfFVm.README.txt
3GPDWEAGj5dYmbfr4zuncDcibkBJ3LHLRS
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
https://tox.chat/download.html
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
Targets
-
-
Target
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
-
Size
151KB
-
MD5
033b58faabb72627b43d7048448e635a
-
SHA1
f29a804d3d98681e556f95351b0ed9c74770e903
-
SHA256
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
-
SHA512
bbee4304bea99f4df82339beff68999f6d544fe021876e6dd2572c3ac4184f3ecddc061e442c20b9a3a4b8b439afcd62f9ebfa6018d7c0b6f51da18658b2f92b
-
SSDEEP
3072:rqJogYkcSNm9V7DOYvvNzONDmi3iluo9dhg+rxaeP8MT:rq2kc4m9tDptOckiYo9d6mYek
Score10/10-
Renames multiple (304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-