3354eb021b78cf44f76a51fb31d640e6afd1c00812a14bc7e78b80998398ad8f

General

Target

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
Size

71KB
MD5

0bbb9b0d573a9c6027ca7e0b1f5478bf
SHA1

59e756e0da6a82a0f9046a3538d507c75eb95252
SHA256

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec
SHA512

69e35a67c1d714a2b3db1ddaa3aef8accbf1c867a2de8c27b3488f77055947d954d4b6a8c62e59f7a835fad8e8148a2a4e744090889fc6d5cc18da5aa7a1c032
SSDEEP

1536:G+5geBR2Q+a8M124Zl2i5SADBDg8trv4t9MBY5yMv:GDeBgQ+a8M12Y2i59hrvWMBIv

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 14 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DismountPublish.tif => C:\users\admin\pictures\dismountpublish.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\EnableComplete.crw => C:\users\admin\pictures\enablecomplete.crw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\MeasureSelect.tif => C:\users\admin\pictures\measureselect.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File opened for modification	C:\users\admin\pictures\resumeunpublish.tiff	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\StepProtect.raw => C:\users\admin\pictures\stepprotect.raw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\BackupConvertFrom.tif => C:\users\admin\pictures\backupconvertfrom.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\ConvertFind.tif => C:\users\admin\pictures\convertfind.tif.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\OutCheckpoint.crw => C:\users\admin\pictures\outcheckpoint.crw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\PublishRead.png => C:\users\admin\pictures\publishread.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\UnprotectPop.raw => C:\users\admin\pictures\unprotectpop.raw.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\CompressHide.png => C:\users\admin\pictures\compresshide.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\ResumeUnpublish.tiff => C:\users\admin\pictures\resumeunpublish.tiff.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\SearchNew.png => C:\users\admin\pictures\searchnew.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
File renamed	C:\Users\Admin\Pictures\UpdateBlock.png => C:\users\admin\pictures\updateblock.png.bluesky	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1924 cmd.exe

pid	process
1924	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

pid	process
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

288 PING.EXE

pid	process
288	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

pid	process
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

description pid process

Token: SeDebugPrivilege 1940 b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

pid process

1940 b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

description	pid	process
Token: SeDebugPrivilege	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.execmd.exe

description	pid	process	target process
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	cmd.exe
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	cmd.exe
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	cmd.exe
PID 1940 wrote to memory of 1924	1940	b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe	cmd.exe
PID 1924 wrote to memory of 288	1924	cmd.exe	PING.EXE
PID 1924 wrote to memory of 288	1924	cmd.exe	PING.EXE
PID 1924 wrote to memory of 288	1924	cmd.exe	PING.EXE
PID 1924 wrote to memory of 288	1924	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe
"C:\Users\Admin\AppData\Local\Temp\b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe"
1⤵
- Modifies extensions of user files
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\b5b105751a2bf965a6b78eeff100fe4c75282ad6f37f98b9adcd15d8c64283ec.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-56-0x0000000000000000-mapping.dmp

Download
memory/1924-55-0x0000000000000000-mapping.dmp

Download
memory/1940-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads