bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

Submit
Reports

Overview

overview

Static

static

TrojanRans...29.exe

windows7-x64

TrojanRans...29.exe

windows10-2004-x64

source/Bat...er.exe

windows7-x64

source/Bat...er.exe

windows10-2004-x64

source/Bat...lp.chm

windows7-x64

source/Bat...lp.chm

windows10-2004-x64

source/Cov29Cry.exe

windows7-x64

source/Cov29Cry.exe

windows10-2004-x64

source/Cov...v4.exe

windows7-x64

source/Cov...v4.exe

windows10-2004-x64

source/Cov...ry.exe

windows7-x64

source/Cov...ry.exe

windows10-2004-x64

source/Cov...en.exe

windows7-x64

source/Cov...en.exe

windows10-2004-x64

source/Cov...en.exe

windows7-x64

source/Cov...en.exe

windows10-2004-x64

source/Tro...29.bat

windows7-x64

source/Tro...29.bat

windows10-2004-x64

source/mbr.exe

windows7-x64

source/mbr.exe

windows10-2004-x64

Analysis

max time kernel
94s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 20:27

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx chaos

4 signatures

Behavioral task

behavioral1

Sample

TrojanRansomCovid29.exe

Resource

win7-20240903-en

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx

windows7-x64

30 signatures

150 seconds

Behavioral task

behavioral2

Sample

TrojanRansomCovid29.exe

Resource

win10v2004-20241007-en

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan upx

windows10-2004-x64

32 signatures

150 seconds

Behavioral task

behavioral3

Sample

source/Bat To Exe Converter/Bat_To_Exe_Converter.exe

Resource

win7-20240903-en

discovery upx

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral4

Sample

source/Bat To Exe Converter/Bat_To_Exe_Converter.exe

Resource

win10v2004-20241007-en

discovery upx

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral5

Sample

source/Bat To Exe Converter/help.chm

Resource

win7-20241010-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

source/Bat To Exe Converter/help.chm

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

source/Cov29Cry.exe

Resource

win7-20240708-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral8

Sample

source/Cov29Cry.exe

Resource

win10v2004-20241007-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows10-2004-x64

22 signatures

150 seconds

Behavioral task

behavioral9

Sample

source/Cov29Cry/Chaos Ransomware Builder v4.exe

Resource

win7-20240903-en

chaos ransomware

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral10

Sample

source/Cov29Cry/Chaos Ransomware Builder v4.exe

Resource

win10v2004-20241007-en

chaos ransomware

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral11

Sample

source/Cov29Cry/Cov29Cry.exe

Resource

win7-20240729-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral12

Sample

source/Cov29Cry/Cov29Cry.exe

Resource

win10v2004-20241007-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows10-2004-x64

22 signatures

150 seconds

Behavioral task

behavioral13

Sample

source/Cov29LockScreen.exe

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

source/Cov29LockScreen.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

source/Cov29LockScreen/Cov29LockScreen.exe

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

source/Cov29LockScreen/Cov29LockScreen.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

source/TrojanRansomCovid29.bat

Resource

win7-20240903-en

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

windows7-x64

29 signatures

150 seconds

Behavioral task

behavioral18

Sample

source/TrojanRansomCovid29.bat

Resource

win10v2004-20241007-en

chaos bootkit defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

windows10-2004-x64

31 signatures

150 seconds

Behavioral task

behavioral19

Sample

source/mbr.exe

Resource

win7-20240708-en

bootkit persistence

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

source/mbr.exe

Resource

win10v2004-20241007-en

bootkit discovery persistence

windows10-2004-x64

2 signatures

150 seconds

Report Analysis Logs

General

Target

source/Bat To Exe Converter/help.chm
Size

14KB
MD5

ffa8c49b21b077b0dc4b51a1f6f9a753
SHA1

5fe5b4d96b266b29bd7aaf41b32394f58e7416e2
SHA256

00037bfc41afacf262afda160e17d3cca33606276324e99bbd93ad1207e9a7c0
SHA512

751eeaef0828ec4416569291ebf3f434208ff43405221339688ec2535cd5947d58ad4d2fd8ea073aa0554f712783f5ec8d5f42dfc4ee935d2905bc541ccd0a9b
SSDEEP

192:TQ3bVqwNUWqaGA9yb6OmVbelnchhvm2I2S1O:TQLbNJqHA9YYVbCahvm280

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1628	hh.exe
1628	hh.exe

Processes

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\source\Bat To Exe Converter\help.chm"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1628

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads