Resubmissions
23/02/2024, 23:29
240223-3gn18scd5w 923/02/2024, 22:31
240223-2fh8xsae24 922/02/2024, 14:24
240222-rqwlwsbd65 9Analysis
-
max time kernel
147s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22/02/2024, 14:24
General
-
Target
3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623.exe
-
Size
4.5MB
-
MD5
fe025d0f649ab10b399efd628fa8df3e
-
SHA1
30a824aa97b286e0088b9191ce47e547c1120921
-
SHA256
3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623
-
SHA512
47cdd4e41bbf00366347dcfb01e4693a21514a0be0b96a782eddca175b8f2a9d77bf2461929a4620677e59c729bbe20668cf1ea5a4df0b20b7a5acc5540e25ba
-
SSDEEP
98304:Ov2Ppnz/doAD1FWM9MSq7QPYR/LeouroTfzYSzcNXH33pQBswnmB:pRnjdoATaSqkPsyvroTfzYmcNH3pIU
Malware Config
Signatures
-
Renames multiple (580) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 2 IoCs
-
Modifies registry class 5 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623.exe"C:\Users\Admin\AppData\Local\Temp\3a659609850664cbc0683c8c7b92be816254eb9306e7fb12ad79d5a9af0fb623.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\59A.tmp"C:\ProgramData\59A.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\59A.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D4A4915E-6706-4ADC-A683-3555A093F6EE}.xps" 1335308550413500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\JBw1fC8JE.README.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD54fd1575d85c05cba044e5646c8155d0f
SHA1dd113772ef1c0445cae4a4ee4ad80f7ec10ad3a3
SHA256e6baa8a42833de451e053b422555e2fee999182c84e79acfdbd091723774ed1e
SHA512824c457fc3c1b282fbe78866eb8233275a499821cb42c291d3130f7ef70bb5624e5e7d76ed93a305de804cbaadb9f81d21351a00dc768c9bc757839dd366dd85
-
Filesize
1KB
MD59d7e4865c0dd17f1e97df83c2bffd548
SHA1c2aa122d4e3b829e415f61450e3f9ed9eea4c818
SHA2565e30c21218619d5d832f90bbc008c09df8bb232304e8a8bfc223e4ae9e501e1f
SHA51285d789a34732495738ca4ab7a91939c5d2d3416bbfdb258fc70035826306235fd21b7196d0f7a6b693ad9f4bc7ecc72cd45e02734bf02e8e5583baee5660de95
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
1.8MB
MD5bca64cab9050708e527716025f2b26bf
SHA10fc84d926370267bed46fa49af2b421c361ceb4e
SHA2566476716e90ca53fc7925453043be63fde74737c470d36ff34996a4af10984c0b
SHA512067121deced8caabb49336d6afd80ef512b9696daab3c45c3b0aa809fac822694390dd1f68c62ef5ec67e76ce2a3890cc700919b10856ffd0ce124645642385e
-
Filesize
4KB
MD5d6215ebed3202151c39d254b61689380
SHA1e9895211c352e7da3b0e2a82b4688636473fcf13
SHA256eb5c5d3218c3e94823ca7af4d328d75685dfa81004c1c1df335b7cd32710cfae
SHA5120b5de03c58fc561fd53bd51059cfad33a1b9b78c508c79f8953b175b5b6a8bb5f2a26843c11f2b786f505485adf389ef606c63db4267ee581d7bbc509b1cce49
-
Filesize
129B
MD5b146effd44415e990811086ef78b3935
SHA126fc2e67c5b7753c5a0cae153dbaa3ddef215853
SHA2565e019bf52892a27fbe63807e12fcdcffcfcca7cb833ff1d6d22ddcb55df8bd5f
SHA5123543c821c2e399c4ab5dbc6422f5119472b7985b423774c1534e02c39256a1e1e8593a97602af3902f9694496bde4898776cc2f243642ff4ecc5bb442e45407d
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.0MB
-
Filesize
64KB