Resubmissions
27-01-2024 19:37
240127-yb5pksafd3 1027-01-2024 19:36
240127-ybqwesafc2 1012-05-2021 15:56
210512-db4t7vmwas 10Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
27-01-2024 19:37
General
-
Target
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe
-
Size
59KB
-
MD5
3fd9b0117a0e79191859630148dcdc6d
-
SHA1
cf04fa736baf22a2ca4e67f1c7723f1776267e28
-
SHA256
27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
-
SHA512
c5175720f432c157eb34da92b29a15f1d7cee77240be12289d5cdb52419dd448b2081a579f783fd48d6226d49057eb3e79f38d85d335761089386a621d1419de
-
SSDEEP
768:vjjmbIax7F3DS4/S9NbnASghx2/ZGNePXPz+3+sT9BmXkY23W58:0x7Fu4/iNbASw2xGNaXrtsp2/Z58
Malware Config
Signatures
-
Renames multiple (187) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Modifies Control Panel 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe"C:\Users\Admin\AppData\Local\Temp\27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
17KB
MD5852ad81348de26bb5980a281b2d040e6
SHA12e6e7d431c2fd9c59cf3a5b21115da1946bc7587
SHA2564eda6aee59bc6098643dbc164d29d7fbb0c377349e494c014144c1d1c3afd4e2
SHA51213d8c8a94e1e7b633d214bbb1f41159f87e878197d002ff452d3f448418bc7052fb322aa7ba4f4263dee4ff374dd0920816b3a7710a7af29a5502c6c4413ac9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD500dfcede93e66b869f9983f1dad60261
SHA1e5d6162dd717e0b8b1b8390e5ece02c9cd7ac02b
SHA256fb7f68aa89364143d5d56d8dd0b6f47c84f7b8337ff89b7644dcb4ffdea928cf
SHA5128dbd41420290ce018a9f1359b6ead95b1408489ddddcf94c5b5f6fb2fcb81f52a7d1457e900c10efb7b92af5fcc06b6cae308444b79dee1421ddc4a890884f94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\Tar22A3.tmpFilesize
31KB
MD5cd36aecc4562a499de8080616e1c3675
SHA1861ca9ee569ebd4759a0f7ba7f7796381aa0f72e
SHA256ac46d26f5f25ed205bd2a8d876b70a6eaaf87361a917f0b3bf75ff9889c1f72b
SHA5129641b2d4919048ecb72fb39a90fb3ae3d884fd1803f28576be6ded0334638f4dc36328bee0f2ce9ff12517093c19d3df192f1c9db572334c6b9e2b136e0497d9