General
-
Target
20125033936.zip
-
Size
320KB
-
Sample
241202-cqmawszjeq
-
MD5
832a3b2bdd95486e9cb651853170b5ac
-
SHA1
2ddaa2721db8ec9c054994fa2110ecccfcd48892
-
SHA256
e31d56289c1957053630383ff71959cba08521874410bd78e46680788490e9cd
-
SHA512
5747ad665694fc76336c206f6917111ad9c380bcc1d92802791e7b0d235da8f167f210700f1cb16993e09dcf9a4684026d99bdf87f5bc6ddf7829336b33c46ff
-
SSDEEP
6144:ePP9y8PLj5WBhpnbKGvekXrCPTe3baza1Whe6l1ivojaookujfr0hHwF7rZo502c:ePPNPLLGv12PTe3+OO3l1pjaookW06qO
Static task
static1
Behavioral task
behavioral1
Sample
f028a27430e5cca11911b70a85e3ec826e17d5501028f78da9452fbb3ec6bdca.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f028a27430e5cca11911b70a85e3ec826e17d5501028f78da9452fbb3ec6bdca.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\READ_NOTE.html
http://xfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onion
Extracted
F:\$RECYCLE.BIN\READ_NOTE.html
http://xfycpauc22t5jsmfjcaz2oydrrrfy75zuk6chr32664bsscq4fgyaaqd.onion
Targets
-
-
Target
f028a27430e5cca11911b70a85e3ec826e17d5501028f78da9452fbb3ec6bdca
-
Size
663KB
-
MD5
7df4d51141b1c657e2c5f78ada3b526a
-
SHA1
d0bbec49bbf722aa102e3cbd548cfec5f88dd6a8
-
SHA256
f028a27430e5cca11911b70a85e3ec826e17d5501028f78da9452fbb3ec6bdca
-
SHA512
fed221cf7f27d3e74023457c58e903e55aa14a608db36df341e8bef2b2cb751ca1fb90da1e6a091ed0fbab70347e67365398c1af51815bec1da0ff330e35b54a
-
SSDEEP
12288:UIj+Lg10Vgi+ve+Ge5JFzLZQMDObpph0lhSMXl+XXenm1hdLQ:Uc+k18+ve+Ge53LuMKHh0lhSMXlYei
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (5711) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-