e1520adc5a4b52323127c67437519ad9c1becf7c0a6834ef9e4a4b734345f381

Analysis

Target

Random.RANSOM.bin.exe
Size

64KB
MD5

bc234901a4e7dd764b97105a4f6840b9
SHA1

9930e609f8a0b4c999e52799f6267e86b66f7188
SHA256

d2178841fa9e74c19c7d19da870c5beb0dd30cb36b70dd6a2e3488416cab9980
SHA512

9285bbd6e19fd4488a371e54b9bd460207cc29670ada23dc445a352c912edf78536196398bbc49fada73ef2884eb5125dad928ac1a96ba64a46c80904ecf0a4c

Score

8^/10

ransomware

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1508	604	Random.RANSOM.bin.exe	25
PID 604 wrote to memory of 1508	604	Random.RANSOM.bin.exe	25
PID 604 wrote to memory of 1508	604	Random.RANSOM.bin.exe	25

Executes dropped EXE 1 IoCs

pid	Process
1508	svchost.exe

Deletes itself 1 IoCs

pid	Process
1508	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File created	C:\Users\Admin\Pictures\GetUpdate.png.RANDOM	svchost.exe
File created	C:\Users\Admin\Pictures\HideEdit.png.RANDOM	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Random.RANSOM.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Random.RANSOM.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:604
- C:\Users\Admin\Appdata\svchost.exe
  "C:\Users\Admin\Appdata\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Suspicious use of AdjustPrivilegeToken
  - Modifies extensions of user files
  PID:1508