Overview

overview

10

Static

static

URLScan

urlscan

https://github.com/E...

windows7_x64

10

Analysis

  • max time kernel
    379s
  • max time network
    376s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    17-11-2021 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/InfinityCrypt.zip

Score
10/10
infinitylockransomware

Malware Config

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/InfinityCrypt.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:812
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\InfinityCrypt\" -spe -an -ai#7zMap19090:88:7zEvent5208
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:912
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0xc8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:976
  • C:\Users\Admin\Downloads\InfinityCrypt\[email protected]
    "C:\Users\Admin\Downloads\InfinityCrypt\[email protected]"
    1⤵
    • Executes dropped EXE
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1780
  • C:\Users\Admin\Downloads\InfinityCrypt\[email protected]
    "C:\Users\Admin\Downloads\InfinityCrypt\[email protected]"
    1⤵
    • Executes dropped EXE
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1220
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:604
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1168
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2020
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1892
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\deployment.properties
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\deployment.properties"
        2⤵
          PID:1528

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/756-55-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

        Filesize

        8KB

        Download

      • memory/756-57-0x0000000004920000-0x0000000004921000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1220-80-0x00000000047F0000-0x00000000047F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1220-108-0x00000000047F5000-0x0000000004806000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1528-115-0x000000006BFE1000-0x000000006BFE4000-memory.dmp

        Filesize

        12KB

        Download

      • memory/1780-62-0x0000000001180000-0x0000000001181000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1780-64-0x0000000075881000-0x0000000075883000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1780-65-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1780-109-0x0000000004DB5000-0x0000000004DC6000-memory.dmp

        Filesize

        68KB

        Download