Analysis
- max time kernel
150s - max time network
99s - platform
windows10_x64 - resource
win10v20201028 - submitted
26/02/2021, 11:37
General
- Target SPREADTHECORRUPTION.exe
- Size 425KB
- Sample210226-4cte82r1vs
- SHA256 5e7f8b2a39176df856d2fe25a5bfcf0915cc72aa114efe92797b674434dc3d47
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
- Drops desktop.ini file(s) 5 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1232-2-0x0000000073CB0000-0x000000007439E000-memory.dmp
memory/1232-3-0x00000000004A0000-0x00000000004A1000-memory.dmp
memory/1232-5-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1232-6-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/1232-7-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/1232-8-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/1232-9-0x0000000004DA3000-0x0000000004DA5000-memory.dmp