Analysis
-
max time kernel
152s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-09-2022 16:53
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe
Resource
win10v2004-20220812-en
General
-
Target
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe
-
Size
218KB
-
MD5
325229663face78b4494f54eb2c77524
-
SHA1
00d64f749b359ec6d304cbd918118755762ddaa5
-
SHA256
47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90
-
SHA512
83fc59059ed4a03ae0b7b592d4b5fa15bc70180a5a792ad8f8b68c2d0c42556ea1f257e38aab2229dd640aced588998460ffea75c02243d61b477bce74c1f5d0
-
SSDEEP
6144:aZSNIPmoXWBoqiNab5jYDy375Qvq5ybpaJDr:hiPyBj5jGy3FkNwJv
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe -
Disables Task Manager via registry modification
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exedescription ioc process File created C:\Users\Admin\Pictures\ShowWait.png.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\UnregisterAssert.tif.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\ReadClose.crw.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\EnableAssert.tif.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\GrantLimit.raw.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\InvokeExit.png.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\ResumeConvertFrom.png.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\SplitClear.png.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\UseAdd.png.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File created C:\Users\Admin\Pictures\DismountOpen.raw.kfuald HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe -
Drops desktop.ini file(s) 3 IoCs
Processes:
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe File opened for modification C:\Users\Admin\Documents\desktop.ini HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exepid process 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exedescription pid process Token: SeDebugPrivilege 2008 HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.MSIL.Diztakun.gen-47f5c7a0c27b925d9c1513ac73eecab3953327beda396fea0b2bbbe15467cb90.exe"1⤵
- Modifies WinLogon for persistence
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken