6053a717d2b7edc7bfd6b07512adfca204883d66f5eddb00e432a5f16cc32b28

Analysis

max time kernel
113s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 09:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

RedEye-Ransomware-master/NewRedEye/obj/Debug/NewRedEye.exe
Size

34.6MB
MD5

a16493f64983e95b47f4c23a43b54015
SHA1

fa596483355bb89e1c767cf33ea2911633daa574
SHA256

8b69a3aa3d2dc1eff7cce69cbd0d7bb8d3c178e218a80f3eae36ea7868ce8892
SHA512

7396c831bbe70eba699af2ba749bc428a6fc143d4a27cc547213925514653a152947c70dc161e3f19422094a186ff74a6c04a20f11a164418d42d1ee47fa3938
SSDEEP

786432:Zg1mbZFph3NKjsqydxM0Xb96BxTRZSvmrIXAphIh0vxwTjFxOfZdac:ZumbJesqyd+0Xb6xTRUvmkXAfIh3nFkN

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	NewRedEye.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NewRedEye = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RedEye-Ransomware-master\\NewRedEye\\obj\\Debug\\NewRedEye.exe"	NewRedEye.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NewRedEye = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RedEye-Ransomware-master\\NewRedEye\\obj\\Debug\\NewRedEye.exe"	NewRedEye.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	NewRedEye.exe
File opened for modification	C:\autorun.inf	NewRedEye.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "37"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
344	NewRedEye.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	232	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	232	AUDIODG.EXE
Token: SeDebugPrivilege	344	NewRedEye.exe
Token: SeShutdownPrivilege	1080	shutdown.exe
Token: SeRemoteShutdownPrivilege	1080	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 1080	344	NewRedEye.exe	100
PID 344 wrote to memory of 1080	344	NewRedEye.exe	100
PID 344 wrote to memory of 1080	344	NewRedEye.exe	100

C:\Users\Admin\AppData\Local\Temp\RedEye-Ransomware-master\NewRedEye\obj\Debug\NewRedEye.exe
"C:\Users\Admin\AppData\Local\Temp\RedEye-Ransomware-master\NewRedEye\obj\Debug\NewRedEye.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" -r -t 00 -f
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3942855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-0-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/344-1-0x0000000000910000-0x0000000002BBA000-memory.dmp

Filesize
34.7MB

Download
memory/344-2-0x00000000075A0000-0x000000000763C000-memory.dmp

Filesize
624KB

Download
memory/344-3-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/344-4-0x0000000007BF0000-0x0000000008194000-memory.dmp

Filesize
5.6MB

Download
memory/344-5-0x00000000076E0000-0x0000000007772000-memory.dmp

Filesize
584KB

Download
memory/344-6-0x0000000007540000-0x0000000007550000-memory.dmp

Filesize
64KB

Download
memory/344-7-0x0000000007660000-0x000000000766A000-memory.dmp

Filesize
40KB

Download
memory/344-8-0x0000000007870000-0x00000000078C6000-memory.dmp

Filesize
344KB

Download
memory/344-9-0x0000000007540000-0x0000000007550000-memory.dmp

Filesize
64KB

Download
memory/344-15-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads