Analysis
-
max time kernel
4294189s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
11-03-2022 16:17
Static task
static1
Behavioral task
behavioral1
Sample
CAD.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
CAD.exe
Resource
win10v2004-en-20220113
General
-
Target
CAD.exe
-
Size
261KB
-
MD5
1c249309871bae43fe787df7976df355
-
SHA1
12da8b967fd7a4a64f3836372430c5862ee24528
-
SHA256
8a1d46b80f61c17f62139c1b46be9208e09055e821d8bed59532089fa5b21b48
-
SHA512
8127487529543ff3d5240bc4ea7fc3c6dd8f802ea522267c3b73224dfc13bbcac311c521c636f5874306d9694e19d1e71a1b4d25b2ac1c57d1a82d095ce47d73
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
cadransomware@gmail.com - Password:
AAss2288
Signatures
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
CAD.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\OpenTrace.tiff CAD.exe File renamed C:\Users\Admin\Pictures\OpenTrace.tiff => C:\Users\Admin\Pictures\OpenTrace.tiff.partially.fucked CAD.exe File renamed C:\Users\Admin\Pictures\RegisterInvoke.png => C:\Users\Admin\Pictures\RegisterInvoke.png.partially.fucked CAD.exe File renamed C:\Users\Admin\Pictures\RenameMount.tif => C:\Users\Admin\Pictures\RenameMount.tif.partially.fucked CAD.exe File opened for modification C:\Users\Admin\Pictures\RevokeMount.tiff CAD.exe File renamed C:\Users\Admin\Pictures\ConnectSelect.tif => C:\Users\Admin\Pictures\ConnectSelect.tif.partially.fucked CAD.exe File renamed C:\Users\Admin\Pictures\ConvertFromComplete.png => C:\Users\Admin\Pictures\ConvertFromComplete.png.partially.fucked CAD.exe File renamed C:\Users\Admin\Pictures\ExitRedo.tif => C:\Users\Admin\Pictures\ExitRedo.tif.partially.fucked CAD.exe File renamed C:\Users\Admin\Pictures\RevokeMount.tiff => C:\Users\Admin\Pictures\RevokeMount.tiff.partially.fucked CAD.exe -
Drops startup file 1 IoCs
Processes:
CAD.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini CAD.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 40 IoCs
Processes:
CAD.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X35V0ZKL\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Videos\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QVSMV6J0\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini CAD.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9WQZNFH4\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Searches\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini CAD.exe File opened for modification C:\Users\Admin\Links\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YXYDN81Q\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Documents\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Music\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318MUB20\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini CAD.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9H7KS8W3\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9Z3MD1WX\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini CAD.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini CAD.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6GA0X34V\desktop.ini CAD.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CAD.exedescription pid process Token: SeDebugPrivilege 1560 CAD.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WORDPAD.EXEpid process 1612 WORDPAD.EXE 1612 WORDPAD.EXE 1612 WORDPAD.EXE 1612 WORDPAD.EXE 1612 WORDPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\CAD.exe"C:\Users\Admin\AppData\Local\Temp\CAD.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\CAD Recovery Information.txt1⤵
-
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\CAD Recovery Information.txt"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\CAD Recovery Information.txtMD5
e7c28e706b566263442f9ee1720d97a1
SHA11af9ea1a4bd58ed200b1908e6273c5d058bc8dfd
SHA256804b96e24ce539fdc7a1929442a7d543a82741750352ae0087cef2ab53cc6343
SHA5121857373bf55d5e5512b664bb1c49bcb8d22855891532a23232db4e64a3cd701e970beeda6650e9a90e401b893eb56ef28514811658ddd11cbebabbd0a5c7c979
-
memory/1560-54-0x0000000001070000-0x00000000010B6000-memory.dmpFilesize
280KB
-
memory/1560-55-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmpFilesize
9.9MB
-
memory/1560-58-0x00000000024C0000-0x000000001A4C0000-memory.dmpFilesize
384.0MB
-
memory/1612-62-0x0000000001FB0000-0x0000000001FB1000-memory.dmpFilesize
4KB
-
memory/1744-59-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmpFilesize
8KB