Analysis

  • max time kernel
    379s
  • max time network
    1560s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    14-11-2021 09:50

General

  • Target

    PremiereCrack.exe

  • Size

    602KB

  • MD5

    34fd3756e03a0fc6002b269412262f04

  • SHA1

    c5f9c5edac33caddc0f170ce3cae385b3f04df87

  • SHA256

    331d3332d59dced547bb96d913112cfd2de67f488c541c35fea78c66f3729965

  • SHA512

    863a900185a819c45cd99390ee0477453c3637674dd37e6d3ef567519739d8ca45320caedc93125d6aaf95bb7814b24b6d16c726d70e90aca08b2ee83c0f7380

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops file in Program Files directory 64 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PremiereCrack.exe
    "C:\Users\Admin\AppData\Local\Temp\PremiereCrack.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:4024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4024-118-0x0000000000400000-0x0000000000402000-memory.dmp

    Filesize

    8KB

  • memory/4024-121-0x00000000008F0000-0x00000000008F1000-memory.dmp

    Filesize

    4KB

  • memory/4024-122-0x00000000008B0000-0x00000000008DA000-memory.dmp

    Filesize

    168KB

  • memory/4024-123-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

    Filesize

    4KB

  • memory/4024-124-0x0000000004E10000-0x0000000004E11000-memory.dmp

    Filesize

    4KB

  • memory/4024-125-0x0000000005310000-0x0000000005311000-memory.dmp

    Filesize

    4KB

  • memory/4024-126-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/4024-127-0x0000000005470000-0x0000000005471000-memory.dmp

    Filesize

    4KB

  • memory/4024-128-0x0000000006B10000-0x0000000006B11000-memory.dmp

    Filesize

    4KB

  • memory/4024-129-0x00000000008F3000-0x00000000008F5000-memory.dmp

    Filesize

    8KB