Analysis
-
max time kernel
4294181s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
05-03-2022 17:57
Static task
static1
Behavioral task
behavioral1
Sample
3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe
-
Size
425KB
-
MD5
8e2ccd9284e09ccc4e9eef325a83b435
-
SHA1
7710f609e7623a08f0dd7cb8fae1ff38d0c729ef
-
SHA256
3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824
-
SHA512
9827bdb32c04127ee0ccc41be9c84df40e7d2aa30c68dc9f9e5bfabcd920478884bbec0f3f8ddcbe5fba2eafafa3437b37af161d59fc39daa92202e2f884247f
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\MergeExpand.tiff 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\InitializeWatch.png => C:\Users\Admin\Pictures\InitializeWatch.png.7632F09778498E44E2E6EBB66FF0EDCEB9DA32CCD9611C6FCF0FF45C23F6AE77 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\OpenStart.tif => C:\Users\Admin\Pictures\OpenStart.tif.EAD161F1940DD85C0E1E890F3EDCBBD8DFD6B26DFAFCB09743ABE38C8BB61058 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\OutWatch.crw => C:\Users\Admin\Pictures\OutWatch.crw.0FD22C0660E4B2F21D27B7F12EB46BBFC8A88A94773E920B825646A2528DD759 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\LimitEnter.png => C:\Users\Admin\Pictures\LimitEnter.png.A2D84B863EB579AC22881FEC4D08982B458B87CDBBCF200970658319B781130D 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\RestoreNew.raw => C:\Users\Admin\Pictures\RestoreNew.raw.45AFDD444BB6FC5FFC0A1527DF540B2BF12B984EAC587E823F0F4D7F1D3BF943 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Pictures\SplitSkip.tiff 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\ResumePublish.raw => C:\Users\Admin\Pictures\ResumePublish.raw.39E21A6C063523FA8BB99BDE0DBC6C13007C45E52E292CB9BB140EC782093C2A 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\SplitSkip.tiff => C:\Users\Admin\Pictures\SplitSkip.tiff.10D7880F8E83618A0BEF74AFF95D4C565796BC991D4191B1BAEDCD124BF2557D 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\MergeExpand.tiff => C:\Users\Admin\Pictures\MergeExpand.tiff.4D74D55161EB1407B2012D61AF7F0DE6C9032F88A66A3F9F6A3EE170AA7CF303 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\SplitUnlock.tif => C:\Users\Admin\Pictures\SplitUnlock.tif.DAF4C359839808F7F67ADA8C5DA35969C2A07ABFB5C7AA066B12B8A409D6781A 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File renamed C:\Users\Admin\Pictures\TraceJoin.png => C:\Users\Admin\Pictures\TraceJoin.png.9398277AC5989B84E937FA4BF8A0838BCACC3A9380F82C3E90DD53833B197C21 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 35 IoCs
description ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Documents\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Music\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Links\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AGWPI80M\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Music\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Videos\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AZW6OKHO\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\72C1GWO9\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\M7YMRK48\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\H: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\M: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\U: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\P: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\F: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\G: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\Q: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\W: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\E: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\Y: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\L: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\Z: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\X: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\V: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\T: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\O: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\B: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\N: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\R: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\S: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\J: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe File opened (read-only) \??\K: 3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1776 vssvc.exe Token: SeRestorePrivilege 1776 vssvc.exe Token: SeAuditPrivilege 1776 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe"C:\Users\Admin\AppData\Local\Temp\3f6e996ee4a40d2d19b648669d9146562627359626239324937a5c75f8030824.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
PID:1668
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776