Overview
overview
10Static
static
10Decrypter_1.exe
windows7-x64
1Decrypter_1.exe
windows10-2004-x64
1Decrypter_3.exe
windows7-x64
1Decrypter_3.exe
windows10-2004-x64
1decrypted_1.exe
windows7-x64
1decrypted_1.exe
windows10-2004-x64
4decrypted_...ed.exe
windows7-x64
10decrypted_...ed.exe
windows10-2004-x64
10decrypted_2.exe
windows7-x64
10decrypted_2.exe
windows10-2004-x64
10decrypted_2.exe
windows7-x64
8decrypted_2.exe
windows10-2004-x64
8decrypter_2.exe
windows7-x64
1decrypter_2.exe
windows10-2004-x64
1Analysis
-
max time kernel
197s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/02/2023, 19:33
Behavioral task
behavioral1
Sample
Decrypter_1.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
Decrypter_1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Decrypter_3.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
Decrypter_3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
decrypted_1.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
decrypted_1.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
decrypted_2-cleaned.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral8
Sample
decrypted_2-cleaned.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
decrypted_2.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral10
Sample
decrypted_2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
decrypted_2.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral12
Sample
decrypted_2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
decrypter_2.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral14
Sample
decrypter_2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
decrypted_2-cleaned.exe
-
Size
35KB
-
MD5
c70d0658abc418288cb46aba9eb14bcb
-
SHA1
83c4622ef69c1a24fcd5818170f8711459c3d457
-
SHA256
97f9eba8aaaa437d361f18f5862e3683bf249800b06e7e27d3e00a67b76fce18
-
SHA512
55fde6cb24d8d27308a701c7fe696191b13b055ac39548da24e882e2f30057a4ee9bda7ee5ec9f1c3d751eaff3e1ab3abd5526393792acb95ab36fd87e4256c2
-
SSDEEP
768:qKkBU+GktcKrJWEGIOP6aohhDDFTN/1mtwkOdo3cmhP7BjC:qKVQjaohhtTvkOdJmJU
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1684 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4f23b08f31e19e05b45991905c12da.exe wlninit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4f23b08f31e19e05b45991905c12da.exe wlninit.exe -
Executes dropped EXE 1 IoCs
pid Process 1104 wlninit.exe -
Loads dropped DLL 1 IoCs
pid Process 560 decrypted_2-cleaned.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\bf4f23b08f31e19e05b45991905c12da = "\"C:\\Users\\Admin\\AppData\\Roaming\\wlninit.exe\" .." wlninit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bf4f23b08f31e19e05b45991905c12da = "\"C:\\Users\\Admin\\AppData\\Roaming\\wlninit.exe\" .." wlninit.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created D:\autorun.inf wlninit.exe File created C:\autorun.inf wlninit.exe File opened for modification C:\autorun.inf wlninit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe 1104 wlninit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1104 wlninit.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe Token: 33 1104 wlninit.exe Token: SeIncBasePriorityPrivilege 1104 wlninit.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 560 wrote to memory of 1104 560 decrypted_2-cleaned.exe 28 PID 560 wrote to memory of 1104 560 decrypted_2-cleaned.exe 28 PID 560 wrote to memory of 1104 560 decrypted_2-cleaned.exe 28 PID 560 wrote to memory of 1104 560 decrypted_2-cleaned.exe 28 PID 1104 wrote to memory of 1684 1104 wlninit.exe 29 PID 1104 wrote to memory of 1684 1104 wlninit.exe 29 PID 1104 wrote to memory of 1684 1104 wlninit.exe 29 PID 1104 wrote to memory of 1684 1104 wlninit.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\decrypted_2-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\decrypted_2-cleaned.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Roaming\wlninit.exe"C:\Users\Admin\AppData\Roaming\wlninit.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\wlninit.exe" "wlninit.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1684
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5c70d0658abc418288cb46aba9eb14bcb
SHA183c4622ef69c1a24fcd5818170f8711459c3d457
SHA25697f9eba8aaaa437d361f18f5862e3683bf249800b06e7e27d3e00a67b76fce18
SHA51255fde6cb24d8d27308a701c7fe696191b13b055ac39548da24e882e2f30057a4ee9bda7ee5ec9f1c3d751eaff3e1ab3abd5526393792acb95ab36fd87e4256c2
-
Filesize
35KB
MD5c70d0658abc418288cb46aba9eb14bcb
SHA183c4622ef69c1a24fcd5818170f8711459c3d457
SHA25697f9eba8aaaa437d361f18f5862e3683bf249800b06e7e27d3e00a67b76fce18
SHA51255fde6cb24d8d27308a701c7fe696191b13b055ac39548da24e882e2f30057a4ee9bda7ee5ec9f1c3d751eaff3e1ab3abd5526393792acb95ab36fd87e4256c2
-
Filesize
35KB
MD5c70d0658abc418288cb46aba9eb14bcb
SHA183c4622ef69c1a24fcd5818170f8711459c3d457
SHA25697f9eba8aaaa437d361f18f5862e3683bf249800b06e7e27d3e00a67b76fce18
SHA51255fde6cb24d8d27308a701c7fe696191b13b055ac39548da24e882e2f30057a4ee9bda7ee5ec9f1c3d751eaff3e1ab3abd5526393792acb95ab36fd87e4256c2