Overview
overview
10Static
static
3Ransom.Win...wn.vbs
windows7-x64
Ransom.Win...wn.vbs
windows10-2004-x64
Ransom.Win...wn.vbs
windows10-ltsc 2021-x64
Ransom.Win...wn.vbs
windows11-21h2-x64
Ransom.Win...rX.vbs
windows7-x64
10Ransom.Win...rX.vbs
windows10-2004-x64
10Ransom.Win...rX.vbs
windows10-ltsc 2021-x64
10Ransom.Win...rX.vbs
windows11-21h2-x64
10other malw...0r.exe
windows7-x64
10other malw...0r.exe
windows10-2004-x64
10other malw...0r.exe
windows10-ltsc 2021-x64
10other malw...0r.exe
windows11-21h2-x64
10other malw...pe.exe
windows7-x64
3other malw...pe.exe
windows10-2004-x64
other malw...pe.exe
windows10-ltsc 2021-x64
other malw...pe.exe
windows11-21h2-x64
other malw...rm.vbs
windows7-x64
1other malw...rm.vbs
windows10-2004-x64
1other malw...rm.vbs
windows10-ltsc 2021-x64
1other malw...rm.vbs
windows11-21h2-x64
1Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-10-2024 15:13
Static task
static1
Behavioral task
behavioral1
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX with shutdown.vbs
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX.vbs
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX.vbs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral8
Sample
Ransom.Win32.LCrypt0rX.A/LCrypt0rX.vbs
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
other malware cuz why not/[email protected]
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
other malware cuz why not/[email protected]
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
other malware cuz why not/[email protected]
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral12
Sample
other malware cuz why not/[email protected]
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
other malware cuz why not/NoEscape.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
other malware cuz why not/NoEscape.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
other malware cuz why not/NoEscape.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral16
Sample
other malware cuz why not/NoEscape.exe
Resource
win11-20241023-en
Behavioral task
behavioral17
Sample
other malware cuz why not/loveletterworm.vbs
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
other malware cuz why not/loveletterworm.vbs
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
other malware cuz why not/loveletterworm.vbs
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral20
Sample
other malware cuz why not/loveletterworm.vbs
Resource
win11-20241007-en
General
-
Target
other malware cuz why not/NoEscape.exe
-
Size
666KB
-
MD5
989ae3d195203b323aa2b3adf04e9833
-
SHA1
31a45521bc672abcf64e50284ca5d4e6b3687dc8
-
SHA256
d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
-
SHA512
e9d4e6295869f3a456c7ea2850c246d0c22afa65c2dd5161744ee5b3e29e44d9a2d758335f98001cdb348eaa51a71cd441b4ddc12c8d72509388657126e69305
-
SSDEEP
12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TB:s487pcZEgwcDpg1L2tbPR2t
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
NoEscape.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NoEscape.exe