Analysis
-
max time kernel
249s -
max time network
255s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2024 15:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8910b2027972c981e85da40f9869b5c2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
19 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
-
Target
8910b2027972c981e85da40f9869b5c2.exe
-
Size
61KB
-
MD5
8910b2027972c981e85da40f9869b5c2
-
SHA1
db400e592c40874f66a12b19d8e5a04ec3edf424
-
SHA256
fa2c56fde9e9006a859c409ed90594d4422bebf9eccc64fd70ac296eea2e47ac
-
SHA512
9895ce3f1456cd2825a81046ce8d9072e1db2df7d5d5f44ee3452e3de4be60961b1d0150ea1236dd17fd9886638666a0a7550121c940dd3b8285c605e29a0f2a
-
SSDEEP
768:TKsMqCXfVcWeHM9ZkiANIU/jYLDwUzc80gmq3oP/oDv:TKseKM9ZkiAP0r/0O8/oz
Score
10/10
Malware Config
Signatures
-
Nitro
A ransomware that demands Discord nitro gift codes to decrypt files.
-
Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8910b2027972c981e85da40f9869b5c2.exe\"" 8910b2027972c981e85da40f9869b5c2.exe -
Drops desktop.ini file(s) 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini 8910b2027972c981e85da40f9869b5c2.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 8910b2027972c981e85da40f9869b5c2.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 8910b2027972c981e85da40f9869b5c2.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8910b2027972c981e85da40f9869b5c2.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8910b2027972c981e85da40f9869b5c2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 23 discord.com 24 discord.com 25 discord.com 63 discord.com 21 discord.com 22 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 api.ipify.org 9 api.ipify.org -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\wallpaper.png" 8910b2027972c981e85da40f9869b5c2.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2896 1820 WerFault.exe 82 4400 1820 WerFault.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 8910b2027972c981e85da40f9869b5c2.exe 1820 8910b2027972c981e85da40f9869b5c2.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4660 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 1820 8910b2027972c981e85da40f9869b5c2.exe Token: SeIncreaseQuotaPrivilege 4240 WMIC.exe Token: SeSecurityPrivilege 4240 WMIC.exe Token: SeTakeOwnershipPrivilege 4240 WMIC.exe Token: SeLoadDriverPrivilege 4240 WMIC.exe Token: SeSystemProfilePrivilege 4240 WMIC.exe Token: SeSystemtimePrivilege 4240 WMIC.exe Token: SeProfSingleProcessPrivilege 4240 WMIC.exe Token: SeIncBasePriorityPrivilege 4240 WMIC.exe Token: SeCreatePagefilePrivilege 4240 WMIC.exe Token: SeBackupPrivilege 4240 WMIC.exe Token: SeRestorePrivilege 4240 WMIC.exe Token: SeShutdownPrivilege 4240 WMIC.exe Token: SeDebugPrivilege 4240 WMIC.exe Token: SeSystemEnvironmentPrivilege 4240 WMIC.exe Token: SeRemoteShutdownPrivilege 4240 WMIC.exe Token: SeUndockPrivilege 4240 WMIC.exe Token: SeManageVolumePrivilege 4240 WMIC.exe Token: 33 4240 WMIC.exe Token: 34 4240 WMIC.exe Token: 35 4240 WMIC.exe Token: 36 4240 WMIC.exe Token: SeIncreaseQuotaPrivilege 4240 WMIC.exe Token: SeSecurityPrivilege 4240 WMIC.exe Token: SeTakeOwnershipPrivilege 4240 WMIC.exe Token: SeLoadDriverPrivilege 4240 WMIC.exe Token: SeSystemProfilePrivilege 4240 WMIC.exe Token: SeSystemtimePrivilege 4240 WMIC.exe Token: SeProfSingleProcessPrivilege 4240 WMIC.exe Token: SeIncBasePriorityPrivilege 4240 WMIC.exe Token: SeCreatePagefilePrivilege 4240 WMIC.exe Token: SeBackupPrivilege 4240 WMIC.exe Token: SeRestorePrivilege 4240 WMIC.exe Token: SeShutdownPrivilege 4240 WMIC.exe Token: SeDebugPrivilege 4240 WMIC.exe Token: SeSystemEnvironmentPrivilege 4240 WMIC.exe Token: SeRemoteShutdownPrivilege 4240 WMIC.exe Token: SeUndockPrivilege 4240 WMIC.exe Token: SeManageVolumePrivilege 4240 WMIC.exe Token: 33 4240 WMIC.exe Token: 34 4240 WMIC.exe Token: 35 4240 WMIC.exe Token: 36 4240 WMIC.exe Token: SeDebugPrivilege 4660 taskmgr.exe Token: SeSystemProfilePrivilege 4660 taskmgr.exe Token: SeCreateGlobalPrivilege 4660 taskmgr.exe Token: SeBackupPrivilege 880 svchost.exe Token: SeRestorePrivilege 880 svchost.exe Token: SeSecurityPrivilege 880 svchost.exe Token: SeTakeOwnershipPrivilege 880 svchost.exe Token: 35 880 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe 4660 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1732 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2108 1820 8910b2027972c981e85da40f9869b5c2.exe 83 PID 1820 wrote to memory of 2108 1820 8910b2027972c981e85da40f9869b5c2.exe 83 PID 1820 wrote to memory of 2108 1820 8910b2027972c981e85da40f9869b5c2.exe 83 PID 2108 wrote to memory of 4240 2108 cmd.exe 85 PID 2108 wrote to memory of 4240 2108 cmd.exe 85 PID 2108 wrote to memory of 4240 2108 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8910b2027972c981e85da40f9869b5c2.exe"C:\Users\Admin\AppData\Local\Temp\8910b2027972c981e85da40f9869b5c2.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 23122⤵
- Program crash
PID:2896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 16642⤵
- Program crash
PID:4400
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4660
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
PID:880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1820 -ip 18201⤵PID:2336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1820 -ip 18201⤵PID:2208
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3951055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1732