Analysis
- max time kernel
150s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
26/02/2021, 11:28
General
- Target SPREADTHECORRUPTION.exe
- Size 425KB
- Sample210226-p6webfglhn
- SHA256 5e7f8b2a39176df856d2fe25a5bfcf0915cc72aa114efe92797b674434dc3d47
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
- Drops desktop.ini file(s) 5 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"C:\Users\Admin\AppData\Local\Temp\SPREADTHECORRUPTION.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3116-2-0x0000000073840000-0x0000000073F2E000-memory.dmp
memory/3116-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/3116-5-0x0000000005C60000-0x0000000005C61000-memory.dmp
memory/3116-6-0x00000000055E0000-0x00000000055E1000-memory.dmp
memory/3116-7-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/3116-8-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/3116-9-0x00000000058A3000-0x00000000058A5000-memory.dmp