Analysis
- max time kernel
122s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/01/2022, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1.bin.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1.bin.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1.bin.dll
- Size 66KB
- Sample220109-rne65adee3
- SHA256 6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1
- MD5 cac54670bc5a9fa936487640a718c269
- SHA1 20f802801a424e2a57ff21e048734fe21f0c57c0
- SHA512 deb19457c7dbc5e865a919936dd9178f80722835fbce4d9f105ce5e6bb4afd8a56dc7b4bb6d3e4b902f88e5321d98ac4daeaa2027e88a3cc4c69d7566fdf1ffe
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\PublishEdit.crw => \??\c:\Users\Admin\Pictures\PublishEdit.crw.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\ResizeDismount.raw => \??\c:\Users\Admin\Pictures\ResizeDismount.raw.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\UnprotectRestore.raw => \??\c:\Users\Admin\Pictures\UnprotectRestore.raw.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\ConfirmBlock.raw => \??\c:\Users\Admin\Pictures\ConfirmBlock.raw.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\ConvertFromAssert.raw => \??\c:\Users\Admin\Pictures\ConvertFromAssert.raw.quantum rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\ConvertSkip.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\EnableImport.raw => \??\c:\Users\Admin\Pictures\EnableImport.raw.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\UninstallClear.png => \??\c:\Users\Admin\Pictures\UninstallClear.png.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\ConvertSkip.tiff => \??\c:\Users\Admin\Pictures\ConvertSkip.tiff.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\GrantFormat.png => \??\c:\Users\Admin\Pictures\GrantFormat.png.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\MoveAdd.crw => \??\c:\Users\Admin\Pictures\MoveAdd.crw.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\UninstallCheckpoint.raw => \??\c:\Users\Admin\Pictures\UninstallCheckpoint.raw.quantum rundll32.exe - Drops desktop.ini file(s) 24 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\Camera Roll\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\Saved Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\OneDrive\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\AccountPictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\desktop.ini rundll32.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created \??\c:\Program Files\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\README_TO_DECRYPT.html rundll32.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\.quantum rundll32.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\.quantum\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\.quantum\shell\Open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\.quantum\shell\Open\command rundll32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 rundll32.exe 2672 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2672 rundll32.exe Token: SeDebugPrivilege 2672 rundll32.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2672 wrote to memory of 1328 2672 rundll32.exe 69 PID 2672 wrote to memory of 1328 2672 rundll32.exe 69 PID 1328 wrote to memory of 780 1328 cmd.exe 71 PID 1328 wrote to memory of 780 1328 cmd.exe 71 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 780 attrib.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1.bin.dll,#11⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0F75F79F.bat" "C:\Users\Admin\AppData\Local\Temp\6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1.bin.dll""2⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\6143d920ebdd5e9b1db7425916417c0896139f425493a8fcd63d62dac80779f1.bin.dll"3⤵
- Views/modifies file attributes
PID:780
-
-