Analysis

  • max time kernel
    43s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-05-2021 09:46

General

  • Target

    PremiereCrack.exe

  • Size

    89KB

  • MD5

    24f89b42a9614bfbdb4c2bf97c0b0257

  • SHA1

    72081b8dafea8abf3cd042d424e9bd751e9e1121

  • SHA256

    0d2137d133179a2fbff7bf38a8125d4b74e9615aaa47b5f4a3056eccce7a8f6e

  • SHA512

    00efae478f575d9c55a225f43002fc28a9c9a4ad6785873f1cfdfe03a84d34a8adc65fb8e41a5c852b7faaf02ec8eb8a7f4d92663aa59d5b9a6a073f1e23817e

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops file in Program Files directory 64 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PremiereCrack.exe
    "C:\Users\Admin\AppData\Local\Temp\PremiereCrack.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4092

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4092-114-0x0000000000690000-0x0000000000691000-memory.dmp

    Filesize

    4KB

  • memory/4092-116-0x0000000004DF0000-0x0000000004E1A000-memory.dmp

    Filesize

    168KB

  • memory/4092-117-0x0000000004F70000-0x0000000004F71000-memory.dmp

    Filesize

    4KB

  • memory/4092-118-0x0000000005510000-0x0000000005511000-memory.dmp

    Filesize

    4KB

  • memory/4092-119-0x00000000050B0000-0x00000000050B1000-memory.dmp

    Filesize

    4KB

  • memory/4092-120-0x0000000005020000-0x0000000005021000-memory.dmp

    Filesize

    4KB

  • memory/4092-121-0x0000000005240000-0x0000000005241000-memory.dmp

    Filesize

    4KB

  • memory/4092-122-0x0000000004E30000-0x0000000004E31000-memory.dmp

    Filesize

    4KB

  • memory/4092-123-0x0000000006E00000-0x0000000006E01000-memory.dmp

    Filesize

    4KB

  • memory/4092-124-0x0000000004E33000-0x0000000004E35000-memory.dmp

    Filesize

    8KB