General
-
Target
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
-
Size
159KB
-
Sample
240905-qx3hcasflb
-
MD5
80f4a1d42e2d4205cedf96909091cf84
-
SHA1
b9500d8a20ea3831f0843ca8636be11fef836625
-
SHA256
9d41b2f7c07110fb855c62b5e7e330a597860916599e73dd3505694fd1bbe163
-
SHA512
42168abc5f69ea35756fa71e1fd49c47b20b4111fc13e4593ae55f576e7f3d9d6583213547cbb01c245e7616b542ee160caa96022ca561eaf290db8818035fd3
-
SSDEEP
3072:/V2UzNeZWtTsi2OHAXDCtY6cgtz45qS7IfJJoSl:NHReZETV2UAXDzb2icl
Static task
static1
Behavioral task
behavioral1
Sample
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files\7-Zip\!!readme!!!.txt
underground
http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/
Targets
-
-
Target
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
-
Size
159KB
-
MD5
80f4a1d42e2d4205cedf96909091cf84
-
SHA1
b9500d8a20ea3831f0843ca8636be11fef836625
-
SHA256
9d41b2f7c07110fb855c62b5e7e330a597860916599e73dd3505694fd1bbe163
-
SHA512
42168abc5f69ea35756fa71e1fd49c47b20b4111fc13e4593ae55f576e7f3d9d6583213547cbb01c245e7616b542ee160caa96022ca561eaf290db8818035fd3
-
SSDEEP
3072:/V2UzNeZWtTsi2OHAXDCtY6cgtz45qS7IfJJoSl:NHReZETV2UAXDzb2icl
-
Underground Team
Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops desktop.ini file(s)
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-