cde41e7f12e6c1eb4f5fc935c4dc706154eaea25b973b23754e8a0ebdc023767

Analysis

max time kernel
146s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File-Ready.or.Not.v41630_515227.exe
Size

27.5MB
MD5

44f38a48c3d18b99ebb434e8ed22728f
SHA1

0d2ed15ee98daf8ceaf2570786d12288b2e490be
SHA256

cde41e7f12e6c1eb4f5fc935c4dc706154eaea25b973b23754e8a0ebdc023767
SHA512

f77aa94ebc6c874619b6c74887d6faf0bdf53aa6cf0c7d26de1713cfbf3d9ebf68185975700cf1c4c912919f9c0a94042aed59fe3ef08f76f0d8a604a4898de8
SSDEEP

786432:huqpkq8b6McvEVrbYlXFoiM6ofQZTib6fzfHwSN2MbSZNjt3KWAv6C:KFfQZ86fTHwSN2MbSZXKW9C

Score

4^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4872	ffmpeg.exe
2072	ffmpeg.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1512	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3624	File-Ready.or.Not.v41630_515227.exe
3624	File-Ready.or.Not.v41630_515227.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	File-Ready.or.Not.v41630_515227.exe
Token: SeDebugPrivilege	4512	firefox.exe
Token: SeDebugPrivilege	4512	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3624	File-Ready.or.Not.v41630_515227.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
4512	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1808	1840	OpenWith.exe	90
PID 1840 wrote to memory of 1808	1840	OpenWith.exe	90
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 1808 wrote to memory of 4512	1808	firefox.exe	91
PID 4512 wrote to memory of 2648	4512	firefox.exe	92
PID 4512 wrote to memory of 2648	4512	firefox.exe	92
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1008	4512	firefox.exe	93
PID 4512 wrote to memory of 1984	4512	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\File-Ready.or.Not.v41630_515227.exe
"C:\Users\Admin\AppData\Local\Temp\File-Ready.or.Not.v41630_515227.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe
"C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe"
1⤵
- Executes dropped EXE
PID:4872

C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe
"C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe"
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\LICENSE"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\LICENSE
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.0.1104155791\745148407" -parentBuildID 20221007134813 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9a7092b-68a6-4c7d-b4f8-536996a7fbce} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 1852 25c3f3f1758 gpu
      4⤵
      PID:2648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.1.702475667\173268549" -parentBuildID 20221007134813 -prefsHandle 2236 -prefMapHandle 2232 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {158836c9-afdc-4e2e-becc-7932e43f369c} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 2248 25c3f2f2f58 socket
      4⤵
      Checks processor information in registry
      PID:1008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.2.928803235\2000224547" -childID 1 -isForBrowser -prefsHandle 2752 -prefMapHandle 2952 -prefsLen 21601 -prefMapSize 233444 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b0523a0-cfe0-4820-8175-eda84bd81dd2} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 2960 25c3f35da58 tab
      4⤵
      PID:1984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.3.1409694049\300923940" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3564 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cfced12-b7fb-4424-953c-97760e143f5f} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 3612 25c33362f58 tab
      4⤵
      PID:3648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.6.1561495211\1844191342" -childID 5 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe06ab02-051e-4eb3-96b4-28b7f2a99428} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 5248 25c46f1f358 tab
      4⤵
      PID:1076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.5.112224481\1206087723" -childID 4 -isForBrowser -prefsHandle 5056 -prefMapHandle 5060 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9af034f-0a8d-4625-960f-e7838d284204} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 4940 25c46f1e758 tab
      4⤵
      PID:3632
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4512.4.1654344791\1065411546" -childID 3 -isForBrowser -prefsHandle 4884 -prefMapHandle 4876 -prefsLen 26298 -prefMapSize 233444 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fec5ca2-7e54-4e58-9c7c-cf316163d2d2} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" 4920 25c4695ba58 tab
      4⤵
      PID:5092

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\LICENSE

Filesize
34KB

MD5
d32239bcb673463ab874e80d47fae504

SHA1
8624bcdae55baeef00cd11d5dfcfa60f68710a02

SHA256
8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903

SHA512
7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c

Download Submit
C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\README.txt

Filesize
38KB

MD5
05c7d5fdc667561828f764eb3d686889

SHA1
77eab2c4e756b8ea6c08d7983c10a499650e73fd

SHA256
64638abe9d00547c03ea1a94ab0d6188f274fcb4fbe9b59981bfa67344918027

SHA512
4de84fb664d1a51df427d9dc2f8a04b9138684038cb9ba29d8a93a9cca589eebc0d9e92d2c73ee3f973f36e5c1b974eee84b0a8d776458bd7ee7edd14b1df4d0

Download Submit
C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe

Filesize
18.5MB

MD5
bc74144bb266d5f02f76b74fbd1cc7e7

SHA1
e8a3ca9d3ec1fed3abcea179b63f218e105a5606

SHA256
adf74962f986bf1b388b9c9df39e3ef0e0b71c5587c1dc5cacdb1004be1b6eab

SHA512
049b55b335ceabda691abfa10cd943f1a4b418d5ac47e357daba07cd590a1b481b74ca67d7c103f08f36d7be71fa543fe978109ea8dcd49ef317b6207b97a6e2

Download Submit
C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe

Filesize
24.8MB

MD5
635271accb3f1144a38b8ed884e0d59b

SHA1
921b29dc890be268c37638117347febd6a205208

SHA256
09e1227d3ad05b51a49c4f8dc81b0e56d97d81561a60521761e8950f7cc8c51f

SHA512
b12afc87c1abf2511934be096194721faf47703ec7374716591f65c49260fd9da70ec1bb8fc489841beeb04e106c98f500daaa33e543e229b30829bf978c5e2c

Download Submit
C:\Users\Admin\AppData\Roaming\FFmpeg\ffmpeg\bin\ffmpeg.exe

Filesize
79.5MB

MD5
93f90473d66f13b4a1ec2095a29419b0

SHA1
88e4703b0db2cbcc3a74abb9b00698b2332ba639

SHA256
f295229d77225196d9839475026da7a3459b420608656bceec84c39241c38798

SHA512
6fbae98df0f2423a773a2f78870daca8eee40350eaae4ace9a282b1bd7e650281a0fdb2317a9d5e7f3c404603339002fc4ecb41af58a08bc70f02160dd7df996

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
81d09978272e47b8e3396425f69cbd57

SHA1
610aa4dd5baa4d8202d52559ea2035ba118499d1

SHA256
0a6d1e13a54900c9c9b2b3b84372f2157a11cf38d355e72190b80419813813b4

SHA512
5fbdc1f3eeb92ce321661a3329c04aa130d5f96da4c0726e453077da18940d53b7723261d2f2ee5edc1878585d282facc77f56fd4a961306495ef13af87ce6b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\cdbd0913-b214-43c6-9322-6981e0b3fc8d

Filesize
11KB

MD5
35577cdff679ca848fa7bd88f33e8d99

SHA1
e7fb20903f2eab8f736762fa4c8d9980a5840efd

SHA256
c8a5a952e9d952561cd804b1745a273de0c36681acb5ab9e75183b0c9ff5daa4

SHA512
4c6ae8ec853717247efc5393fe49b6cf7c1cc37dd58b25506087044589508aa3388149213597e6e156041c9b943917df665907766a0c33548e5a7facd0de2320

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\datareporting\glean\pending_pings\e72133d9-3514-4edb-ace2-468f2f7c9d95

Filesize
746B

MD5
44c06a85c306710408d88d3a64f5c137

SHA1
7678f7a50b62715069e8fdd765f900863169ab3e

SHA256
e4dd2c073d0a66b5b5c53196f50593285765c523d8aa62722c2da74a3b723ad5

SHA512
3ad5bb432015acbc01efe8ec42113d360a4bf1e130df21e413f71e8334d844b0d31089a69cbddc50127de22ec88f253a4a2133adf10e53af298b0d835f9e0569

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\prefs-1.js

Filesize
6KB

MD5
192f9a3c94f102f1934affff6b9b08f9

SHA1
3b536f05d906e022be9abdbbd22f1a923cd248d1

SHA256
25464d5d4a18abf381adb3a82be6d50ea9d70aa7f8bc2fe7cd1af2e2f4e00b11

SHA512
f2cd74bda9667258d18d33683810616de9856492e03ce5d82053c48a189013440b6d04536726cc1f9ce315af03ba87040b87cec7ea9328bde25cecff3730447b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ri34bmyn.default-release\sessionstore.jsonlz4

Filesize
924B

MD5
965a5d76f89f58f57fdb89136e54b682

SHA1
b988e9e0865873e50e6cee82584d34956e10b051

SHA256
28f6dd03ce77c8f0ef2748bfe2870a279237c8bbfaeb372b07412267ebc1aa25

SHA512
780e3ce9f3370a52edb5a321caf72e0ca40f98ff2f93743d877ef206d89c11f4f152c809b21a6277388d06c7f8d156fc4d7fd960d9415ba7108ca8e84156cdb0

Download Submit
memory/4872-86-0x00007FF757D50000-0x00007FF758D50000-memory.dmp

Filesize
16.0MB

Download