Overview

overview

10

Static

static

10

04df8dd30d...a8.exe

windows7-x64

10

04df8dd30d...a8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 04:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    04df8dd30da8b5853f48cc1ac9b695a8.exe

  • Size

    6.1MB

  • MD5

    04df8dd30da8b5853f48cc1ac9b695a8

  • SHA1

    4c02262c2fea0e99277a99dcbe28a9c370b87c39

  • SHA256

    78f4dd4b0e0bff6009f56a8b97332f600cec39e3c1d0e1cac6c7ee47a4bb9201

  • SHA512

    3ad10c1512e316ff9d02bd5b4573298ae2f6fc8f9d56c66e2c5c4d95fe046e5b14b09e63cea9bca778560ce4b568ebdf70d66a0225b2eaf7e6cd3ba914583b7e

  • SSDEEP

    3072:jnsbblTAByHNgb0nbYlwKsw962CpJid72gqV/6c4LNobbamucc3OD4iEDzyEaE0u:jnsq7hQplBdJ7bP4L8rVE

Score
10/10
discoveryevasionexploitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\LegionReadMe.txt

Ransom Note
Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor. Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) In case of no anwser in 72 hours write us to this email: [email protected] What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh
Wallets

131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

http://mail2tor2zyjdctd.onion/

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Renames multiple (560) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Possible privilege escalation attempt 7 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 7 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04df8dd30da8b5853f48cc1ac9b695a8.exe
    "C:\Users\Admin\AppData\Local\Temp\04df8dd30da8b5853f48cc1ac9b695a8.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Sets desktop wallpaper using registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant %username%:F && takeown /f C:\bootmgr && icacls C:\bootmgr /grant %username%:F && attrib -s -r -h C:\bootmgr && del C:\bootmgr && Exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32 /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4956
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:4804
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\drivers /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1816
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\drivers
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2320
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\LogonUI.exe
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:4504
      • C:\Windows\system32\takeown.exe
        takeown /f C:\bootmgr
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\LogonUI.exe /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:332
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\LegionReadMe.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:228
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k rundll32 user32.dll,UpdatePerUserSystemParameters && Exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4844
  • C:\Windows\system32\rundll32.exe
    rundll32 user32.dll,UpdatePerUserSystemParameters
    1⤵
      PID:1056

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log
      Filesize

      16B

      MD5

      79bb29efb8fb96f11016ce4754e80b6b

      SHA1

      9ed8d422a9926e01c03bff38c34beadf2522ca7c

      SHA256

      5de2e6ca20d8f3b3a7683cce544979246d9eb2f27a94c184d9a50775ebb7ca02

      SHA512

      d742556f9751c6f73dcc2d80fb5e8643fb1613ea4a67cf923c52c310864b6dde95a3a8e4d02c8309c8778e9cab75d528b52e30988a6eedbadbeb61c0ba76df51

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
      Filesize

      340KB

      MD5

      7cfd879613a87418d31354bd52635e54

      SHA1

      992bf80de1bb9c3e81e6dd960400fee95fecdfa2

      SHA256

      e3056a7d74e9afab6061646a54138084664915265e4aca3c6b02ee184fd61fe5

      SHA512

      680902581c6a77808a70467429ed64eb43d4ca9078c4479b01c3c1f03ecf63dd40db903fdc9ed367ecc83e9f627a83184b1e941f6b35976ff0329cbb6c43907d

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
      Filesize

      8KB

      MD5

      ed890ebff57a837bcbee784b268a1d6d

      SHA1

      f2bd0792ca7b275bee7c4ec0b51193e19227dfb3

      SHA256

      1dde681e2814fb5c1babe5cddf4903462db829ce4735ea18bef0345bc0016ced

      SHA512

      3ff5e65b3927bffdc8d940c0739a7628541d8d2a565d3daa941c1deed06b6b4a8e2fd0454d9ad96fcf48d390bdd1ffc835dba7cfea63e5838d17db03973d0b65

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\LegionReadMe.txt
      Filesize

      1KB

      MD5

      7db09a04d53ec49b19596d7836ac2286

      SHA1

      f92b734a6fd58d4a729d14f32bd69d588d03fb70

      SHA256

      eb07471b556a3a18b04c9f14d98f0d8345f6a249a74eea2148af19b50c97c5e7

      SHA512

      fc597891e55cfd69aaf709d20f89c088c6e4632a0f1b3286aaee2d22f98a7f01aaff1f8ec2660086f3434a02d4ea9fa0a5df60eac95abe9be56be8aee6d92897

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20231222_234415402.html
      Filesize

      83KB

      MD5

      a715dc3114bea4b58ae98d4d27b8d7c3

      SHA1

      6edd792735cefe311a85f724ca7925f8d54b0344

      SHA256

      33e689f9a3810c796274404370521d1dee4d443db7eb6466232daad82fffff6f

      SHA512

      5e8ab30c409d6b1c209781fc98420474b3733dd0c7a303b3cc187902d6f180f2f64bf02230857f06f6ae0f031b5ecad9c81d807f067b9aa8d10743a61a346485

      Download Submit

    • memory/3764-691-0x000000001C0F0000-0x000000001C100000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3764-1-0x00007FF819610000-0x00007FF81A0D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3764-616-0x00007FF819610000-0x00007FF81A0D1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/3764-2-0x000000001C0F0000-0x000000001C100000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3764-1129-0x000000001C0F0000-0x000000001C100000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3764-0-0x0000000000F90000-0x00000000015B0000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/3764-1132-0x000000001C0F0000-0x000000001C100000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3764-1133-0x000000001C0F0000-0x000000001C100000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3764-1134-0x000000001C0F0000-0x000000001C100000-memory.dmp

      Filesize

      64KB

      Download