129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7

General

Target

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
Size

269KB
MD5

d0c47bd4b16f5c77ef114004b6b464b0
SHA1

b99d9b3228ce391e4768e5d60895195ed27f2c8f
SHA256

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7
SHA512

dea1242ba53814058219d806f80cc633e61470c9563ff32c2d878e9e4808224ea6fade1098575aab1d3c4d55e2c3be57abcdf52315e4cef0f167ccfa5d42c360

Score

8^/10

persistence ransomware

Malware Config

Signatures

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\OptimizeResume.tiff	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\00FF1C9B74EA = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe\""	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\BC1C9B74EA = "\"C:\\ProgramData\\BC1C9B74EA.exe\""	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Drops desktop.ini file(s) 24 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Users\Public\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Drops file in Program Files directory 2 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Program Files\_HELP_INSTRUCTION.TXT	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
File opened for modification	C:\Program Files (x86)\_HELP_INSTRUCTION.TXT	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Drops file in Windows directory 1 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\Windows\_HELP_INSTRUCTION.TXT	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

NTFS ADS 1 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	ioc	process
File opened for modification	C:\ProgramData\BC1C9B74EA.exe:Zone.Identifier	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

5132 NOTEPAD.EXE
6900 NOTEPAD.EXE

pid	process
5132	NOTEPAD.EXE
6900	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe

description	pid	process	target process
PID 3164 wrote to memory of 5132	3164	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 3164 wrote to memory of 5132	3164	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 3164 wrote to memory of 5132	3164	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 3164 wrote to memory of 6900	3164	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 3164 wrote to memory of 6900	3164	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE
PID 3164 wrote to memory of 6900	3164	129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe	NOTEPAD.EXE

C:\Users\Admin\AppData\Local\Temp\129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe
"C:\Users\Admin\AppData\Local\Temp\129413000ffa71e3f7c6f570dcce518d8eb0040711c8268e9f8f0f419ff261e7.sample.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
2⤵
- Opens file in notepad (likely ransom note)
PID:5132

C:\Windows\SysWOW64\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
2⤵
- Opens file in notepad (likely ransom note)
PID:6900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
MD5
078ff82700871fd513a2a3f95381eebc

SHA1
726fe2cf1d84b57aaacc3473c28c8f5e2b03018f

SHA256
84a7c194eb21d57c48c488e78389b3423b9205bd0244b5d1e63eb4a790eb611f

SHA512
6372d3593c945217006610458a1d4e756445bfb46970687af73080d90532d74ed48d8a0851f782c168c251110a99d383696c3329c8b1c1dbf7eb7d398b663224

Download Submit
C:\Users\Admin\Desktop\_HELP_INSTRUCTION.TXT
MD5
078ff82700871fd513a2a3f95381eebc

SHA1
726fe2cf1d84b57aaacc3473c28c8f5e2b03018f

SHA256
84a7c194eb21d57c48c488e78389b3423b9205bd0244b5d1e63eb4a790eb611f

SHA512
6372d3593c945217006610458a1d4e756445bfb46970687af73080d90532d74ed48d8a0851f782c168c251110a99d383696c3329c8b1c1dbf7eb7d398b663224

Download Submit
memory/3164-114-0x0000000000400000-0x0000000000501000-memory.dmp

Filesize
1.0MB

Download
memory/5132-115-0x0000000000000000-mapping.dmp

Download
memory/6900-117-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads