129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7

General

Target

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
Size

269KB
MD5

d0c47bd4b16f5c77ef114004b6b464b0
SHA1

b99d9b3228ce391e4768e5d60895195ed27f2c8f
SHA256

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7
SHA512

dea1242ba53814058219d806f80cc633e61470c9563ff32c2d878e9e4808224ea6fade1098575aab1d3c4d55e2c3be57abcdf52315e4cef0f167ccfa5d42c360

Score

8^/10

persistence ransomware

Malware Config

Signatures

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\TraceMove.tiff	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe\""	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\BC1C9B74EA = "\"C:\\ProgramData\\BC1C9B74EA.exe\""	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*BC1C9B74EA = "\"C:\\ProgramData\\BC1C9B74EA.exe\""	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Drops desktop.ini file(s) 26 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Music\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Drops file in Program Files directory 2 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Program Files\_HELP_INSTRUCTION.TXT	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Program Files (x86)\_HELP_INSTRUCTION.TXT	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Drops file in Windows directory 1 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Windows\_HELP_INSTRUCTION.TXT	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\ProgramData\BC1C9B74EA.exe:Zone.Identifier	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3164 NOTEPAD.EXE

pid	process
3164	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	pid	process	target process
PID 1840 wrote to memory of 3164	1840	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 1840 wrote to memory of 3164	1840	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 1840 wrote to memory of 3164	1840	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 1840 wrote to memory of 3164	1840	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
"C:\Users\Admin\AppData\Local\Temp\129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
2⤵
- Opens file in notepad (likely ransom note)
PID:3164

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
MD5
9723e2cba330b6dcca263b3d5ccf94ec

SHA1
715851f1e7757352bcad1e6ecf1e90acccf77120

SHA256
a8e9748cb5b7d485cfdf5e82a130818ec186ddf2357479384fdf127605b248e4

SHA512
4b43eaf5a0fd6ac13186422d72b24ccb2cc71624711e6b43f5912fa1b77b42ca09a5dc23393f547245a943b4a4628f1ad40868be48590739b164b7403699fa34

Download Submit
memory/1840-59-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1840-60-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/3164-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads