Analysis
-
max time kernel
148s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-01-2024 15:12
General
-
Target
64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b.exe
-
Size
1.7MB
-
MD5
2b34badcdfb0921ee43548475c0ec5bb
-
SHA1
2cfe28584ae7649e3fe0ae150bfe49f7eabc6cf9
-
SHA256
64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b
-
SHA512
c31ac862ac9211821332aa8fd03110ca3ef89304fead4a900d2190c4a3950d2d6e5704b06ab3edf2ea6c6d3b9c225e5220e62496dc42948ec6125618924f880c
-
SSDEEP
24576:++H1KCVkwjVSjdao2bwzUaSze1AeHm/gcgX+7waf7gm7yZADfBFdOgSeiseIK1S3:399byqze1I3o+rH+MFdOsZvShn9T
Malware Config
Extracted
C:\Users\Admin\3D Objects\read_it.txt
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b.exe"C:\Users\Admin\AppData\Local\Temp\64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Netflorist.exe"C:\Users\Admin\AppData\Roaming\Netflorist.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet1⤵
- Deletes backup catalog
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD58c01fc0897330efa19984569d51593de
SHA186ef2c429ec7f7e68604589e14aa2a4d46b91b97
SHA2568e0bb0b0c5df1549718787f72eec31f9b996940e53a105a1c655a7bdcd15207f
SHA512df6ab338df097c2dfe6b06897e7797af89b89e3a2e1a5ccd6772dcd41aee1077571759bdb81cff772ba636e8c1c411ec69cb3ba87b31961be06fca3b1e652fb7
-
Filesize
1KB
MD54e4c88f65ddfc7e4ed96042cb5da5b76
SHA1086fcef3233df3ab47b63a174c8889a5540a2418
SHA256b4135b7f9a2111e0478dff935711b7362150b72b6b4f9e4f17011b503322078b
SHA512f817e9161abd0aa946678c324eeb61ffd7a573a3b64a8b05102be4250402be760119bc21715dcf7ab54e3992857e975802829a0003dc2d10fac8ec9f042ccb7a
-
Filesize
2KB
MD543b82ac044e293717660f7c30c37341b
SHA18b3ef995e9eea518400eaed53217892dea1564d8
SHA25614eddab9aa0b9552f4c9c586462b6407595f1c17701436af0890254b361a1681
SHA512bca63f9866a8478da6487afc38a81d7ba4b1b5d2915562f1dd32562e3c20f82130e626fdc6b6e2aae9845d493ff74597174fd90b5cfeaa7c1e14525ad6b66efe
-
Filesize
8KB
MD52b279d32c6d4123a3d8f6ec62479fefe
SHA1390a3644e9fc90d855f7c9029f4de89b502efd96
SHA256d9df0d684de13bb52c573a0b8006240448d2284fa78b01884a851895fb45594a
SHA512345274a154e23728be554ac92ffaa5fb7d27712eeceeec289426b580f49753ee6ac62f4bd53be774b147636e275ea2fdcdc40b7f49af7499fe8348a779151abf
-
Filesize
1KB
MD52187b478f3734c1f980a533e7639f9f4
SHA1e8329f012d5a207fbf709cf71bf4710a39362c9e
SHA2565ed5bca3c4a8268af542d017389a550b864ac073a488a144cc130ee9eb20dc78
SHA512b28980f4f5d8b8ec4e1f3f6bc099c95fb1a49058cdddfb072c002ac01e45ad5dff203e34642a49bb426e5d2e84b839754d58a3a8cc503c2beca6b98f44fe14c9
-
Filesize
1B
MD5d1457b72c3fb323a2671125aef3eab5d
SHA15bab61eb53176449e25c2c82f172b82cb13ffb9d
SHA2568a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
SHA512ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB