clop | 90e021b34e295ae9488b18ff093a9b7ef86560758702b90cf293ee03b5b23d46

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 17:49

Target

American Medical Encyclopedia v1.0/crack/MedEncyclopedia.exe
Size

3.5MB
MD5

a9acc6fc0428a5b5236b9cc1c0e44bc8
SHA1

1d178db2a06574275fa24983f3f1d0035b2edae5
SHA256

4a8256ef95e5f23d5925059250a40c1560d409dbfd84667e0b394f705db5a879
SHA512

3c1d8f5ec94386fcf63e9c469a47994be1160e323202b3cea05cf452d71a55f0879063284988d17bf9518760052d55ed29a0e7f0676dacca2af3f92fd5bd43aa
SSDEEP

98304:sMngYhpbyHMCIXrxrm6dbt7FM2iJl1N2b:kYhpbyHMRU6pt7FWl1W

Score

10^/10

clop ransomware

clop
Ransomware discovered in early 2019 which has been actively developed since release.
ransomware clop

Modifies registry class 7 IoCs

Processes:

MedEncyclopedia.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}\T2 = "‡¯®™º¸«¼¥©¢¤£¡"	MedEncyclopedia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}\T3 = "ú"	MedEncyclopedia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}\T4 = "þåûûåøúøþ"	MedEncyclopedia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}\T5 = "ÿ"	MedEncyclopedia.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}\T6 = "1"	MedEncyclopedia.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}	MedEncyclopedia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6BCD7A0-5CDF-11D6-955E-00C0262C4C29}\T1 = "ž˜ƒ‹†"	MedEncyclopedia.exe

C:\Users\Admin\AppData\Local\Temp\American Medical Encyclopedia v1.0\crack\MedEncyclopedia.exe
"C:\Users\Admin\AppData\Local\Temp\American Medical Encyclopedia v1.0\crack\MedEncyclopedia.exe"
1⤵
- Modifies registry class
PID:3664

memory/3664-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3664-1-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/3664-2-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3664-3-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download