f6a4b33ecf988c80b0c5aa280a5a3850f44bb3931ae0d845df7c064803c5f7c7

General

Target

q.exe
Size

26KB
MD5

2c8df3499a2666c107a3a900335b8bd6
SHA1

dcbdd6e56552aa20bd867c43c7e3d4fec9957e49
SHA256

f6a4b33ecf988c80b0c5aa280a5a3850f44bb3931ae0d845df7c064803c5f7c7
SHA512

76b358c23bf11d21b748aef55e2fdaa633dea698eec2933fb2073ed0989574a1935e106a2ab92c0b0ecb1e112be26a708a1aecb2599b9944d8f4906547f2e435
SSDEEP

384:F+Qkwe/MEf4KCd+p5afqJnNiuRCpGP6aax9N7JmTnyvHRfeKiI4ZimJU:F+2eJWMTbiqeGPabsnyvHdTiBAX

Score

8^/10

ransomware spyware stealer

Malware Config

Signatures

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

q.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConvertToSet.raw => \??\c:\users\admin\pictures\ConvertToSet.raw.encrypted	q.exe
File renamed	C:\Users\Admin\Pictures\GrantWait.png => \??\c:\users\admin\pictures\GrantWait.png.encrypted	q.exe
File renamed	C:\Users\Admin\Pictures\ImportComplete.raw => \??\c:\users\admin\pictures\ImportComplete.raw.encrypted	q.exe
File renamed	C:\Users\Admin\Pictures\UnregisterGrant.raw => \??\c:\users\admin\pictures\UnregisterGrant.raw.encrypted	q.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

916 NOTEPAD.EXE

pid	process
916	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

taskmgr.exe

pid	process
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskmgr.exe

description pid process

Token: SeDebugPrivilege 240 taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	240	taskmgr.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

taskmgr.exe

pid	process
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

taskmgr.exe

pid	process
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe
240	taskmgr.exe

C:\Users\Admin\AppData\Local\Temp\q.exe
"C:\Users\Admin\AppData\Local\Temp\q.exe"
1⤵
- Modifies extensions of user files
PID:1940

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:240

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DECRYPT.TXT
1⤵
- Opens file in notepad (likely ransom note)
PID:916

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\DECRYPT.TXT
Filesize
607B

MD5
e357eb9271c77460d19016b793125c53

SHA1
d0c6ac79c3b2c8eb911592eb3f84d354cc5bebbb

SHA256
f87cc0f1caded84e06027100472052da0b32ea9bc75f2f87da18e6b28a4f2789

SHA512
6d46988485a4b9204fb87a08db0a7cfc3dfaf5ad661ba5c3b62e9722c72a4b95b1bdc190383220030ba32cef662cbec1ab9f6a9bad2b2da6adf8dc5d3755cef4

Download Submit
C:\Users\Admin\Desktop\DECRYPT_ReadMe1.TXT.ReadMe
Filesize
4KB

MD5
0e7f3fcea239c2d0c77f1e6bb486846e

SHA1
ac08c9f4ddd880cc50ee822efeea255cbf9e4bf0

SHA256
7080c28f01d0faadd652ad863fc9fdaeda478d18c8ad29754cc54006e5889dd6

SHA512
d3a694689bae1a7e6efb1b5b59be7d6b87819008dda5d8c97fc3df38c09e08266314d3dbbec065a68fe2033084c3c1618cee975f726449e38fe3927b188ac82a

Download Submit
C:\vcredist2010_x86.log.html
Filesize
81KB

MD5
8e429bed7b6b10a2af9971bd25744f35

SHA1
e10658497f31e73e83c5c19e66f2a364154fb380

SHA256
0124bc0dbea6b2faae49f01f35985648f566257e45123bce44b9bca0cd4f3b09

SHA512
d98a320c2ecc96f535e83120ac2abeb4aca6e0792b1e3a34ac6e03d5d93d5163c07382f3f510770b5407a0944e54685e290790d5578b6e9634d7cbac1a29df9c

Download Submit
memory/240-838-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/240-839-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1940-54-0x0000000001360000-0x000000000136C000-memory.dmp

Filesize
48KB

Download
memory/1940-55-0x000000001B110000-0x000000001B190000-memory.dmp

Filesize
512KB

Download
memory/1940-84-0x000000001B110000-0x000000001B190000-memory.dmp

Filesize
512KB

Download
memory/1940-840-0x000000001B110000-0x000000001B190000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads