Overview
overview
10Static
static
10TrojanRans...29.exe
windows7-x64
10TrojanRans...29.exe
windows10-2004-x64
10source/Bat...er.exe
windows7-x64
5source/Bat...er.exe
windows10-2004-x64
5source/Bat...lp.chm
windows7-x64
1source/Bat...lp.chm
windows10-2004-x64
1source/Cov29Cry.exe
windows7-x64
10source/Cov29Cry.exe
windows10-2004-x64
10source/Cov...v4.exe
windows7-x64
10source/Cov...v4.exe
windows10-2004-x64
10source/Cov...ry.exe
windows7-x64
10source/Cov...ry.exe
windows10-2004-x64
10source/Cov...en.exe
windows7-x64
3source/Cov...en.exe
windows10-2004-x64
3source/Cov...en.exe
windows7-x64
3source/Cov...en.exe
windows10-2004-x64
3source/Tro...29.bat
windows7-x64
10source/Tro...29.bat
windows10-2004-x64
10source/mbr.exe
windows7-x64
6source/mbr.exe
windows10-2004-x64
6Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 20:27
Behavioral task
behavioral1
Sample
TrojanRansomCovid29.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
TrojanRansomCovid29.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
source/Bat To Exe Converter/help.chm
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
source/Bat To Exe Converter/help.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
source/Cov29Cry.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
source/Cov29Cry.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
source/Cov29Cry/Chaos Ransomware Builder v4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
source/Cov29Cry/Cov29Cry.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
source/Cov29LockScreen.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
source/Cov29LockScreen.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
source/Cov29LockScreen/Cov29LockScreen.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
source/TrojanRansomCovid29.bat
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
source/TrojanRansomCovid29.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
source/mbr.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
source/mbr.exe
Resource
win10v2004-20241007-en
General
-
Target
source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
-
Size
444KB
-
MD5
76d5900a4adf4c1f2ab8dbfd0a450c4a
-
SHA1
6177a27416519564ecb5d38093d61c9a81d3c290
-
SHA256
7adc1f7ff040628a600f99465bd70e71ad83fecfe60b0f1dadc84b5d262ff350
-
SHA512
286b05ff09d4e85856c251d56902486738d9b2457d9a56ea8a449195b349f2718816099f4602efba88dad592dd6cecefcd0748382888c3026dd585b3e46f0c6e
-
SSDEEP
12288:iYicHMPMDp8WrZtzlqQMB/FS/CiUF7RAfoSBjF:viuMPMDp8mtzbMFFS/CzKF
Malware Config
Signatures
-
resource yara_rule behavioral3/memory/1736-0-0x0000000000400000-0x00000000004FA000-memory.dmp upx behavioral3/memory/1736-5-0x0000000000400000-0x00000000004FA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bat_To_Exe_Converter.exe