Overview

overview

10

Static

static

URLScan

urlscan

https://github.com/E...

windows7_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    16-11-2021 18:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/InfinityCrypt.zip

Score
10/10
infinitylockransomware

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  • Executes dropped EXE 3 IoCs
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/InfinityCrypt.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1368
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap18506:88:7zEvent12579
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1692
  • C:\Users\Admin\Downloads\[email protected]
    "C:\Users\Admin\Downloads\[email protected]"
    1⤵
    • Executes dropped EXE
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1232
  • C:\Users\Admin\Downloads\[email protected]
    "C:\Users\Admin\Downloads\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1784
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1616
  • C:\Users\Admin\Downloads\[email protected]
    "C:\Users\Admin\Downloads\[email protected]"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Checks processor information in registry
    PID:1344

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/956-55-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp

    Filesize

    8KB

    Download

  • memory/956-57-0x0000000003A90000-0x0000000003A91000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1232-64-0x0000000075821000-0x0000000075823000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1232-62-0x0000000001130000-0x0000000001131000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1232-65-0x00000000010F0000-0x00000000010F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1232-132-0x00000000010F5000-0x0000000001106000-memory.dmp

    Filesize

    68KB

    Download

  • memory/1344-137-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1784-77-0x0000000004C10000-0x0000000004C11000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1784-133-0x0000000004C15000-0x0000000004C26000-memory.dmp

    Filesize

    68KB

    Download