Analysis
- max time kernel
150s - max time network
104s - platform
windows7_x64 - resource
win7v20201028 - submitted
26/02/2021, 11:28
General
- Target SPREADTHECORRUPTION.exe
- Size 425KB
- Sample210226-p6webfglhn
- SHA256 5e7f8b2a39176df856d2fe25a5bfcf0915cc72aa114efe92797b674434dc3d47
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies extensions of user files 13 IoCs
Ransomware generally changes the extension on encrypted files.
- Drops desktop.ini file(s) 3 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1152-2-0x0000000074360000-0x0000000074A4E000-memory.dmp
memory/1152-3-0x0000000000D80000-0x0000000000D81000-memory.dmp
memory/1152-5-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/1152-6-0x00000000049A5000-0x00000000049B6000-memory.dmp