Analysis
- max time kernel
144s - max time network
99s - platform
windows7_x64 - resource
win7v20201028 - submitted
26/02/2021, 11:37
General
- Target SPREADTHECORRUPTION.exe
- Size 425KB
- Sample210226-4cte82r1vs
- SHA256 5e7f8b2a39176df856d2fe25a5bfcf0915cc72aa114efe92797b674434dc3d47
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
- Drops desktop.ini file(s) 3 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\___RECOVER__FILES__.jcrypt.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/384-2-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/384-3-0x0000000000070000-0x0000000000071000-memory.dmp
memory/384-5-0x0000000004290000-0x0000000004291000-memory.dmp
memory/384-6-0x0000000004295000-0x00000000042A6000-memory.dmp
memory/756-7-0x000007FEFB9D1000-0x000007FEFB9D3000-memory.dmp
memory/1924-10-0x000007FEF7300000-0x000007FEF757A000-memory.dmp