General
-
Target
.mc_osn.exe
-
Size
42KB
-
Sample
241112-k96smszcja
-
MD5
6096dec7644520ba1a4fdc04183bb62f
-
SHA1
f0eae70b15d663787858a5cc24d8fdf21b67f225
-
SHA256
68dd91e49256ee61ca05a5309db255e9ffe23e8df680ace95d48346e2a39c260
-
SHA512
3680248b7ef0e7304268fa8b277f5c9d823c82185d0137bfa9d756ce9fb6406b1af0be5f4dfb73199a6ba4b175dbca97ac61600f140043a645279110750c8f05
-
SSDEEP
768:LO1oR/vVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDdy6vd8lLF82:LlS1FKnDtkuImg61iW2
Behavioral task
behavioral1
Sample
.mc_osn.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
.mc_osn.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\+README-WARNING+.txt
Targets
-
-
Target
.mc_osn.exe
-
Size
42KB
-
MD5
6096dec7644520ba1a4fdc04183bb62f
-
SHA1
f0eae70b15d663787858a5cc24d8fdf21b67f225
-
SHA256
68dd91e49256ee61ca05a5309db255e9ffe23e8df680ace95d48346e2a39c260
-
SHA512
3680248b7ef0e7304268fa8b277f5c9d823c82185d0137bfa9d756ce9fb6406b1af0be5f4dfb73199a6ba4b175dbca97ac61600f140043a645279110750c8f05
-
SSDEEP
768:LO1oR/vVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDdy6vd8lLF82:LlS1FKnDtkuImg61iW2
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (2803) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in System32 directory
-