Overview
overview
10Static
static
10TrojanRans...29.exe
windows11-21h2-x64
10source/Bat...er.exe
windows11-21h2-x64
7source/Bat...lp.chm
windows11-21h2-x64
1source/Cov29Cry.exe
windows11-21h2-x64
10source/Cov...v4.exe
windows11-21h2-x64
10source/Cov...ry.exe
windows11-21h2-x64
10source/Cov...en.exe
windows11-21h2-x64
3source/Cov...en.exe
windows11-21h2-x64
3source/Tro...29.bat
windows11-21h2-x64
10source/mbr.exe
windows11-21h2-x64
6Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system - submitted
09/08/2024, 09:59
Behavioral task
behavioral1
Sample
TrojanRansomCovid29.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
source/Bat To Exe Converter/help.chm
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
source/Cov29Cry.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
source/Cov29LockScreen.exe
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
source/TrojanRansomCovid29.bat
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
source/mbr.exe
Resource
win11-20240802-en
General
- Target source/Bat To Exe Converter/help.chm
- Size 14KB
- Sample240809-l1gmtstanf
- SHA256 00037bfc41afacf262afda160e17d3cca33606276324e99bbd93ad1207e9a7c0
- MD5 ffa8c49b21b077b0dc4b51a1f6f9a753
- SHA1 5fe5b4d96b266b29bd7aaf41b32394f58e7416e2
- SHA512 751eeaef0828ec4416569291ebf3f434208ff43405221339688ec2535cd5947d58ad4d2fd8ea073aa0554f712783f5ec8d5f42dfc4ee935d2905bc541ccd0a9b
- SSDEEP 192:TQ3bVqwNUWqaGA9yb6OmVbelnchhvm2I2S1O:TQLbNJqHA9YYVbCahvm280
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4052 hh.exe 4052 hh.exe