1341bd6193ea223c05566aaca13fc1152732b67af8344519d6efaaf9ab6ed5f4

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5.exe
Size

1.8MB
MD5

53c1fa0286a21f9269f7c0dd5d6ddcaf
SHA1

07eecfd07af0a7a6758d3141e57fbb252364c6b2
SHA256

1341bd6193ea223c05566aaca13fc1152732b67af8344519d6efaaf9ab6ed5f4
SHA512

e53416018753823b6eb6b4dffa45d7520c8deb116faafa398810d599c27e0316a8c047154fc79612a1ec4ddb96b21bbf4e48a246d09b72eaa83d02668f263831
SSDEEP

24576:9ucUS55cDR3NgJ4zJ1H+QI84rncvGt3nE6vlTlIxBkTde/cfkyg:9ucUS55cHgJIzez8+n9Bn3NTaBkYokyg

Score

10^/10

ransomware

Malware Config

Extracted

Path

F:\How To Restore Your Files.txt

Ransom Note

All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $14469 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:14VdH5HX4aEGg4RMXn5B6LeVs41Uxt7xgR (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/1326c67a-5082-4d81-b695-33a0864b1942/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:4604c53e9f4db4299c4e836a7ad0a7f0eb77538cbc5b6f82073d2ff3236d3f7f

URLs

http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/1326c67a-5082-4d81-b695-33a0864b1942/

https://www.binance.com/en/how-to-buy/bitcoin

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3628 created 3184	3628	5.exe	74

Renames multiple (167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
2684	Dashboard.exe

Loads dropped DLL 1 IoCs

pid	Process
2684	Dashboard.exe

Drops desktop.ini file(s) 16 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Music\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 4640	2684	Dashboard.exe	86

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	5.exe
3628	5.exe
2684	Dashboard.exe
4640	cmd.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2684	Dashboard.exe
4640	cmd.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeBackupPrivilege	1564	vssvc.exe
Token: SeRestorePrivilege	1564	vssvc.exe
Token: SeAuditPrivilege	1564	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3488	WMIC.exe
Token: SeSecurityPrivilege	3488	WMIC.exe
Token: SeTakeOwnershipPrivilege	3488	WMIC.exe
Token: SeLoadDriverPrivilege	3488	WMIC.exe
Token: SeSystemProfilePrivilege	3488	WMIC.exe
Token: SeSystemtimePrivilege	3488	WMIC.exe
Token: SeProfSingleProcessPrivilege	3488	WMIC.exe
Token: SeIncBasePriorityPrivilege	3488	WMIC.exe
Token: SeCreatePagefilePrivilege	3488	WMIC.exe
Token: SeBackupPrivilege	3488	WMIC.exe
Token: SeRestorePrivilege	3488	WMIC.exe
Token: SeShutdownPrivilege	3488	WMIC.exe
Token: SeDebugPrivilege	3488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3488	WMIC.exe
Token: SeRemoteShutdownPrivilege	3488	WMIC.exe
Token: SeUndockPrivilege	3488	WMIC.exe
Token: SeManageVolumePrivilege	3488	WMIC.exe
Token: 33	3488	WMIC.exe
Token: 34	3488	WMIC.exe
Token: 35	3488	WMIC.exe
Token: 36	3488	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3488	WMIC.exe
Token: SeSecurityPrivilege	3488	WMIC.exe
Token: SeTakeOwnershipPrivilege	3488	WMIC.exe
Token: SeLoadDriverPrivilege	3488	WMIC.exe
Token: SeSystemProfilePrivilege	3488	WMIC.exe
Token: SeSystemtimePrivilege	3488	WMIC.exe
Token: SeProfSingleProcessPrivilege	3488	WMIC.exe
Token: SeIncBasePriorityPrivilege	3488	WMIC.exe
Token: SeCreatePagefilePrivilege	3488	WMIC.exe
Token: SeBackupPrivilege	3488	WMIC.exe
Token: SeRestorePrivilege	3488	WMIC.exe
Token: SeShutdownPrivilege	3488	WMIC.exe
Token: SeDebugPrivilege	3488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3488	WMIC.exe
Token: SeRemoteShutdownPrivilege	3488	WMIC.exe
Token: SeUndockPrivilege	3488	WMIC.exe
Token: SeManageVolumePrivilege	3488	WMIC.exe
Token: 33	3488	WMIC.exe
Token: 34	3488	WMIC.exe
Token: 35	3488	WMIC.exe
Token: 36	3488	WMIC.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2684	3628	5.exe	83
PID 3628 wrote to memory of 2684	3628	5.exe	83
PID 3628 wrote to memory of 2684	3628	5.exe	83
PID 2684 wrote to memory of 4640	2684	Dashboard.exe	86
PID 2684 wrote to memory of 4640	2684	Dashboard.exe	86
PID 2684 wrote to memory of 4640	2684	Dashboard.exe	86
PID 2684 wrote to memory of 4640	2684	Dashboard.exe	86
PID 4640 wrote to memory of 1992	4640	cmd.exe	92
PID 4640 wrote to memory of 1992	4640	cmd.exe	92
PID 4640 wrote to memory of 1992	4640	cmd.exe	92
PID 4640 wrote to memory of 1992	4640	cmd.exe	92
PID 1992 wrote to memory of 4432	1992	explorer.exe	95
PID 1992 wrote to memory of 4432	1992	explorer.exe	95
PID 4432 wrote to memory of 3488	4432	cmd.exe	97
PID 4432 wrote to memory of 3488	4432	cmd.exe	97
PID 4640 wrote to memory of 1992	4640	cmd.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3184
- C:\Users\Admin\AppData\Local\Temp\5.exe
  "C:\Users\Admin\AppData\Local\Temp\5.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3628
- C:\Users\Admin\AppData\Roaming\msls31\Dashboard.exe
  "C:\Users\Admin\AppData\Roaming\msls31\Dashboard.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      4⤵
      Drops desktop.ini file(s)
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{314E5405-43C0-4FEE-AF3C-774285496418}'" delete
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
      - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{314E5405-43C0-4FEE-AF3C-774285496418}'" delete
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2482e0be

Filesize
760KB

MD5
da390597ed2162eeb969b62d63c3ec0f

SHA1
48d24c5175aae2654adf7c237ccc7c06389883dc

SHA256
2d1facfbac9bc73e7279e656e5d7a33b0a7df2654a42920856e7584aafaee006

SHA512
3f06f32aa3e9f1f503d46d68e2818e7627b14ec6f6bcdd9789558db81084c2536ae2411f810108f3e394cd5cdc77a16bc94719adf4d802d28fdc86d7a8e480ee

Download Submit
C:\Users\Admin\AppData\Roaming\msls31\Dashboard.exe

Filesize
141KB

MD5
704925ecfdb24ef81190b82de0e5453c

SHA1
1128b3063180419893615ca73ad4f9dd51ebeac6

SHA256
8cc871ee8760a4658189528b4a5d8afe9824f6a13faaf1fe7eb56f2a3ad2d04e

SHA512
ca187015812ddfcaa6515f3a5b780183b4a772801aa14b3f785d6dee9b9aa7db6402a7b346623fd24cf4a28f9856683022b10c3d812f8f2888e25bb218cbf216

Download Submit
C:\Users\Admin\AppData\Roaming\msls31\Dashboard.exe

Filesize
141KB

MD5
704925ecfdb24ef81190b82de0e5453c

SHA1
1128b3063180419893615ca73ad4f9dd51ebeac6

SHA256
8cc871ee8760a4658189528b4a5d8afe9824f6a13faaf1fe7eb56f2a3ad2d04e

SHA512
ca187015812ddfcaa6515f3a5b780183b4a772801aa14b3f785d6dee9b9aa7db6402a7b346623fd24cf4a28f9856683022b10c3d812f8f2888e25bb218cbf216

Download Submit
C:\Users\Admin\AppData\Roaming\msls31\UXCore.dll

Filesize
811KB

MD5
7d872477323ae325f650b06b4f439683

SHA1
2fe866293d86df9d0516d3468635b806a6d36f70

SHA256
4c38f9a9e10732d6acbcd71d9024b07ce2f7f877516a0277632ba301c3306110

SHA512
979ca070811729da622588d685a2f005d906c8515df3a5cd45285c1ce2c2c346fe0dc768c1e9a65588f5037f8f60efc776becd31cf333af1441919094e91e434

Download Submit
C:\Users\Admin\AppData\Roaming\msls31\UXCore.dll

Filesize
811KB

MD5
7d872477323ae325f650b06b4f439683

SHA1
2fe866293d86df9d0516d3468635b806a6d36f70

SHA256
4c38f9a9e10732d6acbcd71d9024b07ce2f7f877516a0277632ba301c3306110

SHA512
979ca070811729da622588d685a2f005d906c8515df3a5cd45285c1ce2c2c346fe0dc768c1e9a65588f5037f8f60efc776becd31cf333af1441919094e91e434

Download Submit
C:\Users\Admin\AppData\Roaming\msls31\calico.dbf

Filesize
627KB

MD5
ec774fad95698c76e2feae1eb7253783

SHA1
9510294214015562b47881e0c1ab82430ee047dd

SHA256
3ac241a3987da616d1afb0783d3593b60fabe528b42e86ad6886430cce9ad8a4

SHA512
dd93bfae49c878e01b86694db2c069db971563816173c41e7ae67a5bd2d2ef1749e584a5ec3b04244353f2328859b1ecc72ece8cc36534ca978002b8bfd547e2

Download Submit
F:\How To Restore Your Files.txt

Filesize
1KB

MD5
a6fea339b14268cd27cec9e091eaf9d3

SHA1
5e66e8168457cb7c4ffc884a0e74803839469fac

SHA256
3feaa616d49ac78917ea76257a0e6b6830ef67d078ec671ff4f3b6dc85ba4fbd

SHA512
f2b66f86a7321a83f5e0f80d98b7eaeb3687f1b2ab928e868dc81960111b37dc2772eb30a5f977dd596ed21f966b5481f5ab629d218bcec7eb7ea783f09bfced

Download Submit
memory/2684-12-0x0000000073BD0000-0x0000000074E24000-memory.dmp

Filesize
18.3MB

Download
memory/3628-1-0x00007FFF9E5F0000-0x00007FFF9E91D000-memory.dmp

Filesize
3.2MB

Download
memory/4640-14-0x0000000073BD0000-0x0000000074E24000-memory.dmp

Filesize
18.3MB

Download
memory/4640-16-0x00007FFFAE870000-0x00007FFFAEA65000-memory.dmp

Filesize
2.0MB

Download
memory/4640-17-0x0000000073BD0000-0x0000000074E24000-memory.dmp

Filesize
18.3MB

Download
memory/4640-18-0x0000000073BD0000-0x0000000074E24000-memory.dmp

Filesize
18.3MB

Download
memory/4640-22-0x0000000073BD0000-0x0000000074E24000-memory.dmp

Filesize
18.3MB

Download