Analysis
-
max time kernel
142s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 13:57
General
-
Target
Photo-064-2021.jpg.scr
-
Size
126KB
-
MD5
ea4cf6019062e5555d81bb5510d79b3d
-
SHA1
0d95aa8ade975b9f85c54cdbabd08906a01e51ee
-
SHA256
9a02671ffb82ee83b8f9afd028af3090ecd494bd7d8d7a2e2cc75f0ac187c3b8
-
SHA512
8f1eb4eb9dd561faf05094552bf6769bbfb614de1c7c96cc568e7f45b22fdcdf7d7d7b518041e1ab15b9781ba85dca69c19b9a75cc85bd4aeea3e0540d9f17c9
Malware Config
Extracted
C:\WERE_MY _FILES.txt
httpps://www.torproject.org/
http://helpqvrg3cc5mvb3.onion/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 28 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 18481 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 2 IoCs
-
Delays execution with timeout.exe 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Photo-064-2021.jpg.scr"C:\Users\Admin\AppData\Local\Temp\Photo-064-2021.jpg.scr" /S1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swhost.exe"C:\Users\Admin\AppData\Local\Temp\swhost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"3⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe > nul4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 16763⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\smhost.exe"C:\Users\Admin\AppData\Local\Temp\smhost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 16043⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
af2583b628a62640d1f4bfdf2075863a
SHA1cafe9a9d2deedb443d52a93a45e99a385e4f65f2
SHA256e8a664c32b08dfaa11ee755ac9a5890214029395eff64ee009366c8cbf8cf3d4
SHA51213a771b634b726fe2b5b71886b4c7875ca4ab6e2d0061074a1d66bd98f555c72cf43349ff1ab9de2166ca261851950e266b67a74995bd21efac37addc4c04688
-
MD5
654e98d30719de2b197311aadece41d2
SHA1e2dc9f7a0256621e767fe2d0ce3b251ab2c037fd
SHA256b624fba4e93efc188408233ae3b7b3c43f0461cfd728bdc7d7c70eeb680a5c26
SHA512ca0d80526849a271925321717f8ba062892722f21ef08a197f208dedc31e34f078bacdfe6beef139ed278461a8ee7c2b4badde5a1c20f39d5d3097e90385ccf4
-
MD5
654e98d30719de2b197311aadece41d2
SHA1e2dc9f7a0256621e767fe2d0ce3b251ab2c037fd
SHA256b624fba4e93efc188408233ae3b7b3c43f0461cfd728bdc7d7c70eeb680a5c26
SHA512ca0d80526849a271925321717f8ba062892722f21ef08a197f208dedc31e34f078bacdfe6beef139ed278461a8ee7c2b4badde5a1c20f39d5d3097e90385ccf4
-
MD5
9e96c9967287f92f1646c0c8a68f3a48
SHA153401dab53f27cab59e5e2f2e2d7d8bfa3699744
SHA256b144cea70ef357f52b0b3fdcad315d0df095c563c2cbe535fb45354133db6a2b
SHA5121acd812c5e93fff4686c3f93f503196660bfc44b9257f5af850b18fd19fd7d82c74c0fc878e79240b1250e6c5168a54bcae7a806f696d5f09b69c197ab8eb924
-
MD5
9e96c9967287f92f1646c0c8a68f3a48
SHA153401dab53f27cab59e5e2f2e2d7d8bfa3699744
SHA256b144cea70ef357f52b0b3fdcad315d0df095c563c2cbe535fb45354133db6a2b
SHA5121acd812c5e93fff4686c3f93f503196660bfc44b9257f5af850b18fd19fd7d82c74c0fc878e79240b1250e6c5168a54bcae7a806f696d5f09b69c197ab8eb924
-
-
-
-
-
-
Filesize
4KB
-
-
-
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
160KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
60KB
-
Filesize
60KB
-
-
-
Filesize
6.9MB
-
Filesize
136KB
-
Filesize
4KB
-
-
-
-
-
-