Overview
overview
10Static
static
10TrojanRans...29.exe
windows10-1703-x64
10source/Bat...er.exe
windows10-1703-x64
7source/Bat...lp.chm
windows10-1703-x64
1source/Cov29Cry.exe
windows10-1703-x64
10source/Cov...v4.exe
windows10-1703-x64
10source/Cov...ry.exe
windows10-1703-x64
10source/Cov...en.exe
windows10-1703-x64
3source/Cov...en.exe
windows10-1703-x64
3source/Tro...29.bat
windows10-1703-x64
10source/mbr.exe
windows10-1703-x64
6Analysis
-
max time kernel
16s -
max time network
21s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-08-2024 11:24
Behavioral task
behavioral1
Sample
TrojanRansomCovid29.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
source/Bat To Exe Converter/help.chm
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
source/Cov29Cry.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
source/Cov29LockScreen.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
source/TrojanRansomCovid29.bat
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
source/mbr.exe
Resource
win10-20240404-en
General
-
Target
source/mbr.exe
-
Size
1.3MB
-
MD5
35af6068d91ba1cc6ce21b461f242f94
-
SHA1
cb054789ff03aa1617a6f5741ad53e4598184ffa
-
SHA256
9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e
-
SHA512
136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169
-
SSDEEP
24576:LT3LlvRiQNGYXCI+b1w30WgvZef6YhuQ5O3h3JMtbu:7XNGDIu8NyMtbu
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 mbr.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbr.exe