Overview
overview
10Static
static
10TrojanRans...29.exe
windows11-21h2-x64
10source/Bat...er.exe
windows11-21h2-x64
7source/Bat...lp.chm
windows11-21h2-x64
1source/Cov29Cry.exe
windows11-21h2-x64
10source/Cov...v4.exe
windows11-21h2-x64
10source/Cov...ry.exe
windows11-21h2-x64
10source/Cov...en.exe
windows11-21h2-x64
3source/Cov...en.exe
windows11-21h2-x64
3source/Tro...29.bat
windows11-21h2-x64
10source/mbr.exe
windows11-21h2-x64
6Analysis
- max time kernel
108s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system - submitted
09/08/2024, 09:59
Behavioral task
behavioral1
Sample
TrojanRansomCovid29.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
source/Bat To Exe Converter/help.chm
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
source/Cov29Cry.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
source/Cov29LockScreen.exe
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
source/TrojanRansomCovid29.bat
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
source/mbr.exe
Resource
win11-20240802-en
General
- Target source/Cov29LockScreen/Cov29LockScreen.exe
- Size 48KB
- Sample240809-l1gmtstanf
- SHA256 6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c
- MD5 f724c6da46dc54e6737db821f9b62d77
- SHA1 e35d5587326c61f4d7abd75f2f0fc1251b961977
- SHA512 6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc
- SSDEEP 768:/PjjisU9FR4GNO9OCo0/E9bx0MpO5oO4A2K8iYBo:/Pjjiz9FCrTGfmoOTrD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cov29LockScreen.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4592 Cov29LockScreen.exe