Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe
Resource
win7-20240508-en
General
-
Target
2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo
-
Size
6.7MB
-
MD5
abf6c77d24d82249a3a0e5d167e71cf8
-
SHA1
298feb7e783ade421670560d32d81d2c6c6abe3c
-
SHA256
78fa1e2a9827a868c6fac570321a35ea7a128704e0e0d4bd39116a0df4078c42
-
SHA512
6ef5fc93ac5a40fa2decee108e03b7be74f3fcb98208b23cea2f3dbacd85cb5a3a38f3e60bbf2e714ca22bbb2ba47c970b58e1ed0ce3b5bc27885ea1f28e08a3
-
SSDEEP
98304:9bmlAgrophaRxIm9UPRodtdCWAUb4+IpSBj/qpNPtXC0CxDgZzjNlo3Yp2V3layG:U15WVOkI4DEBLqpNPpC0RIzV3aurKq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo
Files
-
2024-06-12_abf6c77d24d82249a3a0e5d167e71cf8_bkransomware_metamorfo.exe windows:6 windows x86 arch:x86
6145dd3faece3f4aa0dd67c541ae1824
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleCP
FlushFileBuffers
GetStringTypeW
LCMapStringW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
GetConsoleMode
VirtualProtect
VirtualFree
GetVersionExW
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetModuleFileNameW
SetFilePointerEx
LoadLibraryW
SetStdHandle
WriteConsoleW
Sleep
SuspendThread
IsDebuggerPresent
GetExitCodeThread
GetTempPathW
SetThreadPriority
ReadProcessMemory
SizeofResource
GetUserDefaultLCID
LoadResource
SetFilePointer
GetFileSize
WinExec
SwitchToThread
GetUserDefaultUILanguage
GetSystemInfo
VirtualAlloc
GetFileAttributesW
HeapDestroy
CreateDirectoryW
GetSystemDefaultUILanguage
ReleaseSemaphore
RtlCaptureContext
GetFileType
GetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetProcessHeap
CloseHandle
DuplicateHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapReAlloc
GetCommandLineW
RaiseException
RtlUnwind
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
CreateThread
ExitThread
LoadLibraryExW
HeapFree
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
HeapAlloc
CreateFileW
user32
GetMessageW
ShowWindow
CreateWindowExW
SendMessageW
UpdateWindow
SetCapture
ModifyMenuW
GetCapture
GetWindowTextW
SetScrollPos
SetWindowsHookExA
GetSysColor
CheckDlgButton
FlashWindow
SetDlgItemTextA
GetWindowTextLengthA
GetDlgItemInt
AttachThreadInput
MessageBeep
GetMenuItemInfoW
GetDoubleClickTime
GetDC
GetKeyboardState
GetMenu
SetPropA
SetRect
ReleaseDC
ScrollWindow
CharUpperW
GetDesktopWindow
GetSysColorBrush
CheckRadioButton
GetDlgItemTextW
SetDlgItemTextW
DialogBoxParamA
SetMenuItemInfoW
CheckMenuItem
TranslateMDISysAccel
SetCursor
gdi32
GetTextExtentPoint32A
SetPixel
DeleteObject
CreateBrushIndirect
SelectPalette
IntersectClipRect
RestoreDC
MaskBlt
DeleteDC
GetDIBits
CreateHalftonePalette
CreateBitmap
SelectObject
CreateCompatibleDC
SetMapMode
EndDoc
GetStockObject
UpdateColors
GetWindowOrgEx
advapi32
RegEnumKeyExW
AllocateAndInitializeSid
RegGetKeySecurity
OpenServiceW
OpenSCManagerW
RegQueryInfoKeyW
CopySid
RegUnLoadKeyW
shell32
ShellExecuteExW
CommandLineToArgvW
ExtractIconExW
SHGetFileInfoW
oleaut32
VariantCopy
Sections
.text Size: 690KB - Virtual size: 689KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ