b3ca5d5244aacc4709ac02be2fa3f3525cf5f1e8bc7a8ad6ae3dfa668a8cf531

General

Target
7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
Size 5KB
Sample210609-b9bka38fea
SHA256 7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31
MD5 08c1b410a3c20bcc4cd1ee2906c240af
SHA1 97864c23a1c46e30633c9c3a2ee74e3d6de262a9
SHA512 d11530a312f13b0e24009ba54751bc29d21144c474e8211bfdb3446ed4cac409049e3553eca117b29a2d3898612419bfd8dfc7a89da43c309c30c2fa19479d47
MD5 SHA1 SHA512

Score

8^/10

ransomware spyware stealer

Malware Config

Signatures

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\EnableEnter.crw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\HideAdd.tif.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\MountSync.raw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\SaveUpdate.raw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\SuspendShow.png.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\UseConvertTo.crw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\ConvertFromReceive.crw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\PingMeasure.raw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
File created	C:\Users\Admin\Pictures\RestartSave.raw.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.sick	7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.sick	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\.sick\ = "sick_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell\edit	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\sick_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
936	NOTEPAD.EXE
1220	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1604	1796	rundll32.exe	32
PID 1796 wrote to memory of 1604	1796	rundll32.exe	32
PID 1796 wrote to memory of 1604	1796	rundll32.exe	32

C:\Users\Admin\AppData\Local\Temp\7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe
"C:\Users\Admin\AppData\Local\Temp\7dc40a9e663d516089df8a653d79bcd705425fc74caf56b32f45c4786b51ba31.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
PID:1076

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.sick
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.sick
  2⤵
  PID:1604

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HELP.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:936

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HELP.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-59-0x00000000002F0000-0x00000000002F1000-memory.dmp

Download

memory/1796-61-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp