3354eb021b78cf44f76a51fb31d640e6afd1c00812a14bc7e78b80998398ad8f

General

Target
b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
Size 71KB
Sample230104-d55lfsha41
SHA256 b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec
MD5 0bbb9b0d573a9c6027ca7e0b1f5478bf
SHA1 59e756e0da6a82a0f9046a3538d507c75eb95252
SHA512 69e35a67c1d714a2b3db1ddaa3aef8accbf1c867a2de8c27b3488f77055947d954d4b6a8c62e59f7a835fad8e8148a2a4e744090889fc6d5cc18da5aa7a1c032
SSDEEP 1536:G+5geBR2Q+a8M124Zl2i5SADBDg8trv4t9MBY5yMv:GDeBgQ+a8M12Y2i59hrvWMBIv
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DismountPublish.tif => C:\users\admin\pictures\dismountpublish.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\EnableComplete.crw => C:\users\admin\pictures\enablecomplete.crw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\MeasureSelect.tif => C:\users\admin\pictures\measureselect.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File opened for modification	C:\users\admin\pictures\resumeunpublish.tiff	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\StepProtect.raw => C:\users\admin\pictures\stepprotect.raw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\BackupConvertFrom.tif => C:\users\admin\pictures\backupconvertfrom.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\ConvertFind.tif => C:\users\admin\pictures\convertfind.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\OutCheckpoint.crw => C:\users\admin\pictures\outcheckpoint.crw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\PublishRead.png => C:\users\admin\pictures\publishread.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\UnprotectPop.raw => C:\users\admin\pictures\unprotectpop.raw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\CompressHide.png => C:\users\admin\pictures\compresshide.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\ResumeUnpublish.tiff => C:\users\admin\pictures\resumeunpublish.tiff.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\SearchNew.png => C:\users\admin\pictures\searchnew.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\UpdateBlock.png => C:\users\admin\pictures\updateblock.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Deletes itself 1 IoCs

pid	Process
1924	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
288	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	28
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	28
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	28
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	28
PID 1924 wrote to memory of 288	1924	cmd.exe	30
PID 1924 wrote to memory of 288	1924	cmd.exe	30
PID 1924 wrote to memory of 288	1924	cmd.exe	30
PID 1924 wrote to memory of 288	1924	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
"C:\Users\Admin\AppData\Local\Temp\b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download

Analysis

Sharing