9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6

General

Target

9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
Size

4.4MB
MD5

f155ec35d67f746593ce8cc4e64d33e5
SHA1

822e0997e6c6d577a7803018dedba01a5ec70dc3
SHA256

9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6
SHA512

ed5d2470defa3ecb8cdcdfb6b315ed921ac0719b1a08099f646208770f365866b13e2687dea21f25598d858885d54dd62b60ccefc5c45080bc4ccd6bbc923021
SSDEEP

49152:Jhe0zWNgw7dO4TdK8po/xQPMIevzsdzlCI6aSjJzeP8E6YuSi33fjk77QXpe2Pp/:DahOmIZcevzRIuePPTuLZpzz

Score

8^/10

ransomware spyware stealer upx

Malware Config

Signatures

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExitTrace.png => C:\Users\Admin\Pictures\ExitTrace.png.karen	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File opened for modification	C:\Users\Admin\Pictures\ExportSearch.tiff	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File renamed	C:\Users\Admin\Pictures\ExportSearch.tiff => C:\Users\Admin\Pictures\ExportSearch.tiff.karen	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File opened for modification	C:\Users\Admin\Pictures\InstallUnregister.tiff	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File renamed	C:\Users\Admin\Pictures\InstallUnregister.tiff => C:\Users\Admin\Pictures\InstallUnregister.tiff.karen	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File renamed	C:\Users\Admin\Pictures\SelectSearch.tif => C:\Users\Admin\Pictures\SelectSearch.tif.karen	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File renamed	C:\Users\Admin\Pictures\WaitExit.raw => C:\Users\Admin\Pictures\WaitExit.raw.karen	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1464-54-0x0000000000FF0000-0x0000000001458000-memory.dmp	upx
behavioral1/memory/1464-55-0x0000000000FF0000-0x0000000001458000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 40 IoCs

Processes:

9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B3RNYR1O\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YZA8LC25\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Desktop\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Downloads\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Videos\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNJRVQ2J\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Contacts\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Favorites\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFUI5RSH\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Music\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NFAXYLRV\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\465H0QEB\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Pictures\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Searches\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Documents\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\G2GR9E4N\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Favorites\Links for United States\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\Links\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\16ZRL8F2\desktop.ini	9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe

C:\Users\Admin\AppData\Local\Temp\9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe
"C:\Users\Admin\AppData\Local\Temp\9f35d284afd3dafb2ab44e4a09ec7ef7cb62574282edf847d8deb7e450665bd6.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x0000000000FF0000-0x0000000001458000-memory.dmp

Filesize
4.4MB

Download
memory/1464-55-0x0000000000FF0000-0x0000000001458000-memory.dmp

Filesize
4.4MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads