Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 04:33
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe
-
Size
61KB
-
MD5
dfe6b9554dadfe0878f7ca05897ce13d
-
SHA1
854f32aec164a054b4bf99e5814cb88c10e58d49
-
SHA256
8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74
-
SHA512
f767588f73f4147d57daf6b1b7620b61f059eca10bfbd847875deb2daf46178d925d3308ce58bbe0634880928f154b33d8b1ac95019724fc3c38beae859aaf9c
-
SSDEEP
768:wKsMqCXfVcWQbM9ZkiANIUAVoYLDwUzc80gmq3oP/oDN:wKseEM9ZkiAPgr/0O8/oZ
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\FormatExit.tif.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File created C:\Users\Admin\Pictures\InvokeSwitch.tif.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File created C:\Users\Admin\Pictures\MountSubmit.png.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File created C:\Users\Admin\Pictures\PingBlock.tif.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File created C:\Users\Admin\Pictures\ProtectCheckpoint.raw.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File created C:\Users\Admin\Pictures\AddPop.crw.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File created C:\Users\Admin\Pictures\CompleteSend.tif.givemenitro HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe\"" HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe -
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe File opened for modification C:\Users\Admin\Documents\desktop.ini HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 api.ipify.org 16 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4460 HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe 4460 HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4460 HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe Token: SeIncreaseQuotaPrivilege 4068 WMIC.exe Token: SeSecurityPrivilege 4068 WMIC.exe Token: SeTakeOwnershipPrivilege 4068 WMIC.exe Token: SeLoadDriverPrivilege 4068 WMIC.exe Token: SeSystemProfilePrivilege 4068 WMIC.exe Token: SeSystemtimePrivilege 4068 WMIC.exe Token: SeProfSingleProcessPrivilege 4068 WMIC.exe Token: SeIncBasePriorityPrivilege 4068 WMIC.exe Token: SeCreatePagefilePrivilege 4068 WMIC.exe Token: SeBackupPrivilege 4068 WMIC.exe Token: SeRestorePrivilege 4068 WMIC.exe Token: SeShutdownPrivilege 4068 WMIC.exe Token: SeDebugPrivilege 4068 WMIC.exe Token: SeSystemEnvironmentPrivilege 4068 WMIC.exe Token: SeRemoteShutdownPrivilege 4068 WMIC.exe Token: SeUndockPrivilege 4068 WMIC.exe Token: SeManageVolumePrivilege 4068 WMIC.exe Token: 33 4068 WMIC.exe Token: 34 4068 WMIC.exe Token: 35 4068 WMIC.exe Token: 36 4068 WMIC.exe Token: SeIncreaseQuotaPrivilege 4068 WMIC.exe Token: SeSecurityPrivilege 4068 WMIC.exe Token: SeTakeOwnershipPrivilege 4068 WMIC.exe Token: SeLoadDriverPrivilege 4068 WMIC.exe Token: SeSystemProfilePrivilege 4068 WMIC.exe Token: SeSystemtimePrivilege 4068 WMIC.exe Token: SeProfSingleProcessPrivilege 4068 WMIC.exe Token: SeIncBasePriorityPrivilege 4068 WMIC.exe Token: SeCreatePagefilePrivilege 4068 WMIC.exe Token: SeBackupPrivilege 4068 WMIC.exe Token: SeRestorePrivilege 4068 WMIC.exe Token: SeShutdownPrivilege 4068 WMIC.exe Token: SeDebugPrivilege 4068 WMIC.exe Token: SeSystemEnvironmentPrivilege 4068 WMIC.exe Token: SeRemoteShutdownPrivilege 4068 WMIC.exe Token: SeUndockPrivilege 4068 WMIC.exe Token: SeManageVolumePrivilege 4068 WMIC.exe Token: 33 4068 WMIC.exe Token: 34 4068 WMIC.exe Token: 35 4068 WMIC.exe Token: 36 4068 WMIC.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4460 wrote to memory of 1680 4460 HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe 80 PID 4460 wrote to memory of 1680 4460 HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe 80 PID 4460 wrote to memory of 1680 4460 HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe 80 PID 1680 wrote to memory of 4068 1680 cmd.exe 82 PID 1680 wrote to memory of 4068 1680 cmd.exe 82 PID 1680 wrote to memory of 4068 1680 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.Win32.Generic-8fa5c815959a4b570c6d65f563a93e3366517ea62a3f6c35e835d8ad03e45b74.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-