Resubmissions

15-03-2021 09:09

210315-2zntzgdr72 8

15-03-2021 08:51

210315-mj6e5pvb66 8

13-03-2021 17:09

210313-hrcfblnjbx 8

Analysis

  • max time kernel
    31s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-03-2021 09:09

General

  • Target

    trash.exe

  • Size

    100KB

  • MD5

    7f5227030be3d2ef48aa652af1ec72b0

  • SHA1

    202e7ac1c2aaca8fbeed4ac454ca195a33c9d064

  • SHA256

    4dfc17406a58c6f1ce83a73ce6dd5b343d00fe77d07dfe21d28da13631bfad90

  • SHA512

    4603b758416dac60cb322aae6f3566711b6a4a9b657f6448861553b45b1c737fd3180d2b0bc169ef193a2372e89aba14a4d27a25e0a5eb440ed6c4afafe5f55c

Malware Config

Signatures

  • Modifies extensions of user files 30 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\trash.exe
    "C:\Users\Admin\AppData\Local\Temp\trash.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\trash.exe
      C:\Users\Admin\AppData\Local\Temp\trash
      2⤵
      • Modifies extensions of user files
      • Drops startup file
      PID:1984

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-10-0x0000000002620000-0x0000000002624000-memory.dmp
    Filesize

    16KB

  • memory/1084-9-0x0000000002390000-0x0000000002394000-memory.dmp
    Filesize

    16KB

  • memory/1984-5-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1984-4-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1984-6-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/1984-7-0x0000000000413000-mapping.dmp
  • memory/1984-8-0x00000000767C1000-0x00000000767C3000-memory.dmp
    Filesize

    8KB

  • memory/1984-12-0x0000000000020000-0x0000000000021000-memory.dmp
    Filesize

    4KB

  • memory/1984-11-0x0000000000413000-0x0000000000414000-memory.dmp
    Filesize

    4KB

  • memory/1984-13-0x0000000000413000-0x0000000000414000-memory.dmp
    Filesize

    4KB