General
-
Target
f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb.zip
-
Size
102KB
-
Sample
240426-b3fhfaha99
-
MD5
6206618eb6eb4c44c57624e5aa5169a9
-
SHA1
bf9177ba136d26fdf670fb5688dbde4aead31667
-
SHA256
f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb
-
SHA512
1725f8741c754483f1306b25b198fe607ceb3a2131f1b463279c137009a03e59d8ecafe04c7c93e3b13b50a507eced9a044985f50091a9e0708bfe1e6e27790a
-
SSDEEP
1536:yQ/YWWqGcA3eBfcLT7yC6u7LKFs4rYYEbqHl10xHJ77G7fr9hmdOlBEB3v:yQwJQVcLTOQKS4r1Oglmp7a9hmd+BEBf
Behavioral task
behavioral1
Sample
Document.doc.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Document.doc.scr
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
b7b4c97132d03eead1fa9a9352dee6c2
-
SHA1
c9eb1bdc528076fa9c91668addf0723294ac1575
-
SHA256
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2
-
SHA512
cb0023bc6783a94a27d2d4a67c214e8657fd334d1a94a7dba51277363dee2a67e7ecc5fc0788cead1c4e0e2dc7d9aa758203f89dce162184869d20a44d171903
-
SSDEEP
3072:v6glyuxE4GsUPnliByocWepXKD0/9Wy1Og/ZK99r:v6gDBGpvEByocWehKD0/EWfg3
Score9/10-
Renames multiple (348) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-