ef99a1844cbf354868a70cdcc2584ec94ffceafc4ffcd3a6b5563fa1d632844e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Size

108KB
MD5

04bd0a129ac331d598a08c88f3b99089
SHA1

e2b18d04541e93c7e2c871849061dcea5a77dc95
SHA256

57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe
SHA512

82495d4d2d1319d52e66308bfbbd812334e1cf1cd5b4f84763380556fdeb7790a25f38839c6eb2189f55eedcb48ba08fa74baec25d7b74fd1403660c75f33aa1
SSDEEP

3072:IFLXTOKX8HIBxac8SKfbzxcwg7es6/Vsb8VKTuv:IOfoBdUhcX7elbKTu

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Renames multiple (59) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1632	2640	57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe	28
PID 2640 wrote to memory of 1632	2640	57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe	28
PID 2640 wrote to memory of 1632	2640	57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe	28
PID 2640 wrote to memory of 1632	2640	57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe	28

C:\Users\Admin\AppData\Local\Temp\57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
"C:\Users\Admin\AppData\Local\Temp\57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RIP YO DOCUMENTS.txt
  2⤵
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\RIP YO DOCUMENTS.txt

Filesize
2KB

MD5
6cde18d00a6e933a73079ac7735da4e8

SHA1
58606f48eae23f1f3f064f05a1906b4f433a7a45

SHA256
c89e4b3c1f2ad3838a2098b1ecab24ff7181fed9d4f6483f6ce889f181abe8d7

SHA512
a48341f3a5395278198e186790b27baa428625e4bf137da89e30211b5c9ec77acf262e3ca9207842a6a3adbf921ac52c48002c019495ec129761d81cc8e8f5e1

Download Submit
C:\Users\Admin\Desktop\RIP YO DOCUMENTS.txt

Filesize
3KB

MD5
3794fc8c3412c58252bc268bb7f0c39c

SHA1
9e751ec1e2966b23ad4cdf90f9a707b4b0c1e551

SHA256
54be5ad9ea0c05cbbbd42deb1e6fd4b4a7cc4e699eed2363a10125eb242032f7

SHA512
fec228f78ff75add1d0245a5946f1769c3c2dd0a51e4979b6733e41b9dac3d9355e6d384566eef556dddfcee99c510b6c6a4af9b0e59176e25eda8b09d38e2b2

Download Submit
memory/2640-0-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-1-0x0000000000990000-0x00000000009B2000-memory.dmp

Filesize
136KB

Download
memory/2640-181-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download