Overview
overview
10Static
static
7BitchTits ...P].exe
windows7-x64
7WannaFartCry.exe
windows7-x64
3Wannashiturself.exe
windows7-x64
10big FAT ti...RE.exe
windows7-x64
10big fat se...re.exe
windows7-x64
1bitch man ...re.exe
windows7-x64
8bro what t...at.dll
windows7-x64
7cocksucker...L].exe
windows7-x64
7fart poopy...re.exe
windows7-x64
7fart weewe...re.exe
windows7-x64
10farting po...re.exe
windows7-x64
10farty poo ...re.exe
windows7-x64
10fuck you.exe
windows7-x64
7large peni...24.exe
windows7-x64
niggaware ...29.exe
windows7-x64
10pee poo pi...re.exe
windows7-x64
10retard ransomware.exe
windows7-x64
1Analysis
-
max time kernel
1800s -
max time network
1443s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 14:23
Behavioral task
behavioral1
Sample
BitchTits Ransomware [VIP].exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
WannaFartCry.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
Wannashiturself.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
big FAT tits RANSOMWARE.exe
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
big fat sexy dildo poop ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
bitch man ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral7
Sample
bro what the fuckkk ur seriously beliving that.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
cocksucker ransomware [COOL].exe
Resource
win7-20240704-en
Behavioral task
behavioral9
Sample
fart poopy ransowmare.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
fart weewee ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
farting poop sex ransomware.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
farty poo poo ransomware.exe
Resource
win7-20240705-en
Behavioral task
behavioral13
Sample
fuck you.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
large penis ransomware 2024.exe
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
niggaware ransomware in 2029.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
pee poo piss piss ransomware rare.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
retard ransomware.exe
Resource
win7-20240705-en
General
-
Target
pee poo piss piss ransomware rare.exe
-
Size
418KB
-
MD5
afe081816b33e7d8bdff7f7291fa3718
-
SHA1
b05d2d80f846e95d70463b3096e7412575c5ce54
-
SHA256
acee7b1fe33cae78353a100855e4da887599a504833f47c185373ed079529374
-
SHA512
91604a604d3acccddbbec61854bba80756aea78341c098a66982a4c4c6c0ac3bdf09132b527caaaedceedb4f70539c6df7cc2dd7f029bb1ccb0695c535397c72
-
SSDEEP
12288:I8y5iDtzoYgveS30QRuWlG9GDnH+9XUmwP:IDcCvegHEymw
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
pee poo piss piss ransomware rare.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\programicon.exe" pee poo piss piss ransomware rare.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "eõplorer.exe" pee poo piss piss ransomware rare.exe -
Drops file in System32 directory 3 IoCs
Processes:
pee poo piss piss ransomware rare.exedescription ioc process File created C:\WINDOWS\SysWOW64\eõplorer.exe pee poo piss piss ransomware rare.exe File created C:\WINDOWS\SysWOW64\programicon.exe pee poo piss piss ransomware rare.exe File opened for modification C:\WINDOWS\SysWOW64\programicon.exe pee poo piss piss ransomware rare.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pee poo piss piss ransomware rare.exepid process 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe 1740 pee poo piss piss ransomware rare.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pee poo piss piss ransomware rare.exe"C:\Users\Admin\AppData\Local\Temp\pee poo piss piss ransomware rare.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2452