Analysis
- max time kernel
498s - max time network
365s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
23/01/2022, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
Counter Fuck.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Counter Fuck.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target Counter Fuck.exe
- Size 145KB
- Sample220123-d5pv1aeed3
- SHA256 0a0b9434dff488eaf2f57c3923e03a603c9367445eaae1b5c71e6a79fc95c999
- MD5 35d5df687d9a6512c66a5ea593173ec8
- SHA1 8e6be0c9756048f635fc4faa3fbe76a0ed77923e
- SHA512 1d1d95dfd651ed0fd69432c4c4f807ab61b86756f38b64b12bce1a8e1415ad3d916f36d69e138156c1f9e430351af826dc515001cff6ed8ccf40b8643094d63b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
- Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\ConvertToLock.tif.suckme Counter Fuck.exe File created C:\Users\Admin\Pictures\FormatSplit.crw.suckme Counter Fuck.exe File created C:\Users\Admin\Pictures\ReceiveSkip.png.suckme Counter Fuck.exe File created C:\Users\Admin\Pictures\SyncExport.tiff.suckme Counter Fuck.exe File opened for modification C:\Users\Admin\Pictures\SyncExport.tiff Counter Fuck.exe File created C:\Users\Admin\Pictures\UpdateDismount.raw.suckme Counter Fuck.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Counter Fuck.exe\"" Counter Fuck.exe - Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini Counter Fuck.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini Counter Fuck.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Counter Fuck.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Counter Fuck.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini Counter Fuck.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 api.ipify.org 15 api.ipify.org - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" Counter Fuck.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3260 Counter Fuck.exe 3260 Counter Fuck.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3260 Counter Fuck.exe Token: SeIncreaseQuotaPrivilege 956 WMIC.exe Token: SeSecurityPrivilege 956 WMIC.exe Token: SeTakeOwnershipPrivilege 956 WMIC.exe Token: SeLoadDriverPrivilege 956 WMIC.exe Token: SeSystemProfilePrivilege 956 WMIC.exe Token: SeSystemtimePrivilege 956 WMIC.exe Token: SeProfSingleProcessPrivilege 956 WMIC.exe Token: SeIncBasePriorityPrivilege 956 WMIC.exe Token: SeCreatePagefilePrivilege 956 WMIC.exe Token: SeBackupPrivilege 956 WMIC.exe Token: SeRestorePrivilege 956 WMIC.exe Token: SeShutdownPrivilege 956 WMIC.exe Token: SeDebugPrivilege 956 WMIC.exe Token: SeSystemEnvironmentPrivilege 956 WMIC.exe Token: SeRemoteShutdownPrivilege 956 WMIC.exe Token: SeUndockPrivilege 956 WMIC.exe Token: SeManageVolumePrivilege 956 WMIC.exe Token: 33 956 WMIC.exe Token: 34 956 WMIC.exe Token: 35 956 WMIC.exe Token: 36 956 WMIC.exe Token: SeIncreaseQuotaPrivilege 956 WMIC.exe Token: SeSecurityPrivilege 956 WMIC.exe Token: SeTakeOwnershipPrivilege 956 WMIC.exe Token: SeLoadDriverPrivilege 956 WMIC.exe Token: SeSystemProfilePrivilege 956 WMIC.exe Token: SeSystemtimePrivilege 956 WMIC.exe Token: SeProfSingleProcessPrivilege 956 WMIC.exe Token: SeIncBasePriorityPrivilege 956 WMIC.exe Token: SeCreatePagefilePrivilege 956 WMIC.exe Token: SeBackupPrivilege 956 WMIC.exe Token: SeRestorePrivilege 956 WMIC.exe Token: SeShutdownPrivilege 956 WMIC.exe Token: SeDebugPrivilege 956 WMIC.exe Token: SeSystemEnvironmentPrivilege 956 WMIC.exe Token: SeRemoteShutdownPrivilege 956 WMIC.exe Token: SeUndockPrivilege 956 WMIC.exe Token: SeManageVolumePrivilege 956 WMIC.exe Token: 33 956 WMIC.exe Token: 34 956 WMIC.exe Token: 35 956 WMIC.exe Token: 36 956 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3260 wrote to memory of 4032 3260 Counter Fuck.exe 69 PID 3260 wrote to memory of 4032 3260 Counter Fuck.exe 69 PID 3260 wrote to memory of 4032 3260 Counter Fuck.exe 69 PID 4032 wrote to memory of 956 4032 cmd.exe 71 PID 4032 wrote to memory of 956 4032 cmd.exe 71 PID 4032 wrote to memory of 956 4032 cmd.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\Counter Fuck.exe"C:\Users\Admin\AppData\Local\Temp\Counter Fuck.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-