f255227fd45316c4681085f39e6da2f509af851f8cc2d2a84ea99c06b935ffe6

Submit
Reports

Overview

overview

Static

static

Documents/...er.exe

windows7-x64

Documents/...er.exe

windows10-2004-x64

Documents/...ll.exe

windows7-x64

Documents/...ll.exe

windows10-2004-x64

Documents/...aw.exe

windows7-x64

Documents/...aw.exe

windows10-2004-x64

Documents/...ky.exe

windows7-x64

Documents/...ky.exe

windows10-2004-x64

Documents/...31.exe

windows7-x64

Documents/...31.exe

windows10-2004-x64

Documents/...3 .exe

windows7-x64

Documents/...3 .exe

windows10-2004-x64

Documents/...d9.dll

windows7-x64

Documents/...d9.dll

windows10-2004-x64

027cc450ef...ju.dll

windows7-x64

027cc450ef...ju.dll

windows10-2004-x64

ee29b9c013...bc6.js

windows7-x64

ee29b9c013...bc6.js

windows10-2004-x64

fe2e5d0543...L9.rtf

windows7-x64

fe2e5d0543...L9.rtf

windows10-2004-x64

Documents/...uy.hta

windows7-x64

Documents/...uy.hta

windows10-2004-x64

Documents/...st.exe

windows7-x64

Documents/...st.exe

windows10-2004-x64

Documents/...39.exe

windows7-x64

Documents/...39.exe

windows10-2004-x64

Documents/...5c.exe

windows7-x64

Documents/...5c.exe

windows10-2004-x64

Documents/...00.exe

windows7-x64

Documents/...00.exe

windows10-2004-x64

Supplement...16.scr

windows7-x64

Supplement...16.scr

windows10-2004-x64

Resubmissions

22-08-2024 18:43

21-08-2024 17:16

30-06-2024 00:59

20-06-2024 02:02

20-06-2024 01:44

19-06-2024 01:10

18-06-2024 20:40

18-06-2024 13:45

Analysis

max time kernel
30s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 02:02

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

2 signatures

Behavioral task

behavioral1

Sample

Documents/Ransomware.Cerber/cerber.exe

Resource

win7-20240611-en

cerber discovery evasion persistence privilege_escalation ransomware

windows7-x64

18 signatures

30 seconds

Behavioral task

behavioral2

Sample

Documents/Ransomware.Cerber/cerber.exe

Resource

win10v2004-20240611-en

cerber discovery evasion persistence privilege_escalation ransomware

windows10-2004-x64

15 signatures

30 seconds

Behavioral task

behavioral3

Sample

Documents/Ransomware.Cryptowall/cryptowall.exe

Resource

win7-20231129-en

defense_evasion execution impact persistence ransomware

windows7-x64

11 signatures

30 seconds

Behavioral task

behavioral4

Sample

Documents/Ransomware.Cryptowall/cryptowall.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

30 seconds

Behavioral task

behavioral5

Sample

Documents/Ransomware.Jigsaw/jigsaw.exe

Resource

win7-20240508-en

jigsaw persistence ransomware

windows7-x64

7 signatures

30 seconds

Behavioral task

behavioral6

Sample

Documents/Ransomware.Jigsaw/jigsaw.exe

Resource

win10v2004-20240611-en

jigsaw persistence ransomware

windows10-2004-x64

8 signatures

30 seconds

Behavioral task

behavioral7

Sample

Documents/Ransomware.Locky/Locky.exe

Resource

win7-20240220-en

windows7-x64

0 signatures

30 seconds

Behavioral task

behavioral8

Sample

Documents/Ransomware.Locky/Locky.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

30 seconds

Behavioral task

behavioral9

Sample

Documents/Ransomware.Mamba/131.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

30 seconds

Behavioral task

behavioral10

Sample

Documents/Ransomware.Mamba/131.exe

Resource

win10v2004-20240611-en

windows10-2004-x64

0 signatures

30 seconds

Behavioral task

behavioral11

Sample

Documents/Ransomware.Matsnu/Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe

Resource

win7-20240508-en

persistence upx

windows7-x64

7 signatures

30 seconds

Behavioral task

behavioral12

Sample

Documents/Ransomware.Matsnu/Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe

Resource

win10v2004-20240611-en

windows10-2004-x64

1 signatures

30 seconds

Behavioral task

behavioral13

Sample

Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/027cc450ef5f8c5f653329641ec1fed9.dll

Resource

win7-20240419-en

mimikatz bootkit persistence spyware stealer

windows7-x64

13 signatures

30 seconds

Behavioral task

behavioral14

Sample

Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/027cc450ef5f8c5f653329641ec1fed9.dll

Resource

win10v2004-20240226-en

mimikatz bootkit persistence

windows10-2004-x64

11 signatures

30 seconds

Behavioral task

behavioral15

Sample

027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.dll

Resource

win7-20240611-en

mimikatz bootkit persistence spyware stealer

windows7-x64

13 signatures

30 seconds

Behavioral task

behavioral16

Sample

027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.dll

Resource

win10v2004-20240611-en

mimikatz bootkit persistence spyware stealer

windows10-2004-x64

12 signatures

30 seconds

Behavioral task

behavioral17

Sample

ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6.js

Resource

win7-20240508-en

execution

windows7-x64

1 signatures

30 seconds

Behavioral task

behavioral18

Sample

ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6.js

Resource

win10v2004-20240611-en

execution

windows10-2004-x64

1 signatures

30 seconds

Behavioral task

behavioral19

Sample

fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206_OFkNP1kKL9.rtf

Resource

win7-20240611-en

windows7-x64

3 signatures

30 seconds

Behavioral task

behavioral20

Sample

fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206_OFkNP1kKL9.rtf

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

30 seconds

Behavioral task

behavioral21

Sample

Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/myguy.hta

Resource

win7-20240221-en

execution

windows7-x64

7 signatures

30 seconds

Behavioral task

behavioral22

Sample

Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/myguy.hta

Resource

win10v2004-20240508-en

execution

windows10-2004-x64

7 signatures

30 seconds

Behavioral task

behavioral23

Sample

Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/svchost.exe

Resource

win7-20240220-en

windows7-x64

3 signatures

30 seconds

Behavioral task

behavioral24

Sample

Documents/Ransomware.Petrwrap/Ransomware.Petrwrap/svchost.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

30 seconds

Behavioral task

behavioral25

Sample

Documents/Ransomware.Petya/Ransomware.Petya/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe

Resource

win7-20240419-en

bootkit persistence

windows7-x64

2 signatures

30 seconds

Behavioral task

behavioral26

Sample

Documents/Ransomware.Petya/Ransomware.Petya/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe

Resource

win10v2004-20240508-en

bootkit persistence

windows10-2004-x64

2 signatures

30 seconds

Behavioral task

behavioral27

Sample

Documents/Ransomware.Petya/Ransomware.Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe

Resource

win7-20240221-en

bootkit persistence

windows7-x64

2 signatures

30 seconds

Behavioral task

behavioral28

Sample

Documents/Ransomware.Petya/Ransomware.Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe

Resource

win10v2004-20240226-en

bootkit persistence

windows10-2004-x64

2 signatures

30 seconds

Behavioral task

behavioral29

Sample

Documents/Ransomware.Radamant/Ransomware.Radamant/DUMP_00A10000-00A1D000.exe

Resource

win7-20240611-en

persistence upx

windows7-x64

10 signatures

30 seconds

Behavioral task

behavioral30

Sample

Documents/Ransomware.Radamant/Ransomware.Radamant/DUMP_00A10000-00A1D000.exe

Resource

win10v2004-20240611-en

persistence upx

windows10-2004-x64

10 signatures

30 seconds

Behavioral task

behavioral31

Sample

Supplementary Agreement 26_01_2016.scr

Resource

win7-20240611-en

windows7-x64

2 signatures

30 seconds

Behavioral task

behavioral32

Sample

Supplementary Agreement 26_01_2016.scr

Resource

win10v2004-20240611-en

windows10-2004-x64

1 signatures

30 seconds

Report Analysis Logs

General

Target

Documents/Ransomware.Matsnu/Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
Size

102KB
MD5

1b2d2a4b97c7c2727d571bbf9376f54f
SHA1

1fc29938ec5c209ba900247d2919069b320d33b0
SHA256

7634433f8fcf4d13fb46d680802e48eeb160e0f51e228cae058436845976381e
SHA512

506fc96423e5e2e38078806591e09a6eb3cf924eb748af528f7315aa0b929890823798a3ef2a5809c14023c3ff8a3db36277bc90c7b099218422aafa4e0c2ee0
SSDEEP

1536:jj+Rj1lGIXKSmE17v97yiqHGMRPtbsLW8/V2k12v1/BDxVyCfCrCAc:jjw6Sf0iqmMnb2W02v3mCf4Nc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
392	3428	WerFault.exe	81

Processes

C:\Users\Admin\AppData\Local\Temp\Documents\Ransomware.Matsnu\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe
"C:\Users\Admin\AppData\Local\Temp\Documents\Ransomware.Matsnu\Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .exe"
1⤵
PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 368
  2⤵
  - Program crash
  PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3428 -ip 3428
1⤵
PID:2376

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads