7ed20d7a8f61ce7efb5354bdf8e02b6f3cefa418f8adb9e6d81f70086102e5e8

Resubmissions

28/08/2022, 23:26

220828-3e8ymagabq 5

10/06/2021, 11:42

210610-j9y37a6cma 5

10/06/2021, 11:31

210610-k9s461t52a 5

Analysis

max time kernel
150s
max time network
55s
platform
windows7_x64
resource
win7v20210408
submitted
10/06/2021, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

2.3MB
MD5

84ffb87cc91d697db2f5685df68de7af
SHA1

4f0360d60b685ed6059d32aef24c6b3cbbd46e9e
SHA256

10bba07a1965c61a2ec05b46331e3eeda3d7bdeb8074c86009dc11f2564048fa
SHA512

c6b178f37b2318b4eeaf1e151cac70a10b0be8eeb0e8153bd324a66314a33dca27e43254518a4b2db2ed5cab31ff836e0fa84e2a8112b67772409d77f39d5e9f

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\Notify.jpg"	sample.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "6"	sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\TileWallpaper = "0"	sample.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
344	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
344	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	944	AUDIODG.EXE
Token: 33	944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	944	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
344	vlc.exe
344	vlc.exe
344	vlc.exe
344	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
344	vlc.exe
344	vlc.exe
344	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
344	vlc.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:1696

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1384

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact