Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
18-10-2021 07:10
Static task
static1
Behavioral task
behavioral1
Sample
cac54670bc5a9fa936487640a718c269.exe.dll
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
-
Target
cac54670bc5a9fa936487640a718c269.exe.dll
-
Size
66KB
-
MD5
cac54670bc5a9fa936487640a718c269
-
SHA1
20f802801a424e2a57ff21e048734fe21f0c57c0
-
SHA256
6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1
-
SHA512
deb19457c7dbc5e865a919936dd9178f80722835fbce4d9f105ce5e6bb4afd8a56dc7b4bb6d3e4b902f88e5321d98ac4daeaa2027e88a3cc4c69d7566fdf1ffe
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ConnectUnprotect.png => \??\c:\Users\Admin\Pictures\ConnectUnprotect.png.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\EnterEdit.tif => \??\c:\Users\Admin\Pictures\EnterEdit.tif.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\JoinClear.png => \??\c:\Users\Admin\Pictures\JoinClear.png.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\JoinInitialize.png => \??\c:\Users\Admin\Pictures\JoinInitialize.png.quantum rundll32.exe -
Deletes itself 1 IoCs
pid Process 924 cmd.exe -
Drops desktop.ini file(s) 32 IoCs
description ioc Process File opened for modification \??\c:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini rundll32.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\Program Files\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\README_TO_DECRYPT.html rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.quantum\shell\Open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.quantum rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.quantum\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.quantum\shell\Open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1544 rundll32.exe 1544 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1544 rundll32.exe Token: SeDebugPrivilege 1544 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1544 wrote to memory of 924 1544 rundll32.exe 28 PID 1544 wrote to memory of 924 1544 rundll32.exe 28 PID 1544 wrote to memory of 924 1544 rundll32.exe 28 PID 924 wrote to memory of 1656 924 cmd.exe 30 PID 924 wrote to memory of 1656 924 cmd.exe 30 PID 924 wrote to memory of 1656 924 cmd.exe 30 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1656 attrib.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cac54670bc5a9fa936487640a718c269.exe.dll,#11⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\0F75FE4C.bat" "C:\Users\Admin\AppData\Local\Temp\cac54670bc5a9fa936487640a718c269.exe.dll""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\cac54670bc5a9fa936487640a718c269.exe.dll"3⤵
- Views/modifies file attributes
PID:1656
-
-