Overview

overview

10

Static

static

3

66aac846ad...69.exe

windows7-x64

10

66aac846ad...69.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 04:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    66aac846ad0a79ceaa669df35a575be30b75be919e26442af55af634b0504669.exe

  • Size

    3.2MB

  • MD5

    efb22913c85a1dab034383b94b7dd449

  • SHA1

    56bdcbf5380c202776e1f7aa08edc4a66d42c719

  • SHA256

    66aac846ad0a79ceaa669df35a575be30b75be919e26442af55af634b0504669

  • SHA512

    677af586682b04b591d7348f54e91bb61c664e77d097a34265067a18268ad6dd128b4165ed56f3b2ac4b409d29397e8303a6546bf2c724e77d7f5c882ce370cf

  • SSDEEP

    98304:7F+S5fQ2KhTXHyq7CuLtbuFxkWeYbdoVJY8aQesjZ:7F+yJaCuZbexZhpm1Ze6

Score
10/10
clopransomware

Malware Config

Extracted

Family

clop

Ransom Note
___ Universidad de La Salle ___ === DO NOT ATTEMPT TO RESTORE OR MOVE THE FILES YOURSELF. THIS MAY DESTROY THEM === Here are some of the files we downloaded from your network: \\172.19.20.216\C$\Users\ruthrodriguezez \\172.19.0.25\Secretaria General Docs \\172.19.15.59\C$\Users\sarangel If you refuse to cooperate, all data will be published for free download on our portal: http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/ -> TOR browser CONTACT US BY EMAIL-> [email protected] or [email protected] OR WRITE TO THE CHAT AT-> http://6v4q5w7di74grj2vtmikzgx2tnq5eagyg2cubpcnqrvvee2ijpmprzqd.onion/remote0/93868e77-1331-411a-9643-dc9ad26a5095?secret=lasalle (use TOR browser)

Signatures

  • clop

    Ransomware discovered in early 2019 which has been actively developed since release.

    ransomwareclop

Processes

  • C:\Users\Admin\AppData\Local\Temp\66aac846ad0a79ceaa669df35a575be30b75be919e26442af55af634b0504669.exe
    "C:\Users\Admin\AppData\Local\Temp\66aac846ad0a79ceaa669df35a575be30b75be919e26442af55af634b0504669.exe"
    1⤵
      PID:2440

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2440-0-0x0000000003020000-0x0000000003309000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/2440-1-0x0000000000A80000-0x0000000001076000-memory.dmp

      Filesize

      6.0MB

      Download