Analysis

  • max time kernel
    35s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09/05/2021, 10:26

General

  • Target

    123.exe

  • Size

    89KB

  • MD5

    3822d0484ec81d615a0913c398ad1f83

  • SHA1

    b7bd3e90724189c7316b82a70ce85e0a91855089

  • SHA256

    27a1f89ce5a37815010c8411dddec85d5d66e81a957ad722fbd2dc64f99651c8

  • SHA512

    d103abe81ef9bba19a3f21c8a2742b6a6dad2d147bb440e81b1f17b1d0f67fc3dfa4c33c84ec8b7ca1b107fbd91535ee588d29bded615cff58685eb611665fe8

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops file in Program Files directory 64 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3944-114-0x0000000000D40000-0x0000000000D41000-memory.dmp

    Filesize

    4KB

  • memory/3944-116-0x0000000003040000-0x000000000306A000-memory.dmp

    Filesize

    168KB

  • memory/3944-117-0x00000000056F0000-0x00000000056F1000-memory.dmp

    Filesize

    4KB

  • memory/3944-118-0x0000000005C90000-0x0000000005C91000-memory.dmp

    Filesize

    4KB

  • memory/3944-119-0x0000000005790000-0x0000000005791000-memory.dmp

    Filesize

    4KB

  • memory/3944-120-0x0000000005830000-0x0000000005831000-memory.dmp

    Filesize

    4KB

  • memory/3944-121-0x00000000058A0000-0x00000000058A1000-memory.dmp

    Filesize

    4KB

  • memory/3944-122-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3944-123-0x0000000007B90000-0x0000000007B91000-memory.dmp

    Filesize

    4KB

  • memory/3944-124-0x0000000003083000-0x0000000003085000-memory.dmp

    Filesize

    8KB