70e1a35180a15897ec8bdde4302d20b6330684a9c080a7087f2abb1ca2cfed77

General

Target
GMRansom.exe
Size 228KB
Sample260809-aw1z5afm4y
SHA256 70e1a35180a15897ec8bdde4302d20b6330684a9c080a7087f2abb1ca2cfed77
MD5 8c08affd429c19f15331a0d7c906c1d1
SHA1 96d7019fd162f60b24af1dcef0b21feaec5f88f0
SHA512 6f5d508f1cc13a52aa40b40e472f9d45681c8a08cb0c5a343ad7f2f26d8eb3451a984990c6f042a9a9a69f66941c09c0afed73078f79e4de59af8a3f9c99af9c
SSDEEP 6144:uEOnPjb2Z8XsTyt1gphvfm29cFUekhmPJG:Wnca+phF+J
TLSH
T18D34E005B3BB0D97C27E9AFA66F2811203B7F712659EF78A0E81646D3956B505300BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  GMRansom.exe
- Size 228KB
- SHA256 70e1a35180a15897ec8bdde4302d20b6330684a9c080a7087f2abb1ca2cfed77
- MD5 8c08affd429c19f15331a0d7c906c1d1
- SHA1 96d7019fd162f60b24af1dcef0b21feaec5f88f0
- SHA512 6f5d508f1cc13a52aa40b40e472f9d45681c8a08cb0c5a343ad7f2f26d8eb3451a984990c6f042a9a9a69f66941c09c0afed73078f79e4de59af8a3f9c99af9c
- SSDEEP 6144:uEOnPjb2Z8XsTyt1gphvfm29cFUekhmPJG:Wnca+phF+J
- TLSH
  T18D34E005B3BB0D97C27E9AFA66F2811203B7F712659EF78A0E81646D3956B505300BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1