Analysis
- max time kernel
155s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/03/2024, 21:38
Behavioral task
behavioral1
Sample
VoiceMod-Full-Version-Setup/Voicemod_setup.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
VoiceMod-Full-Version-Setup/Voicemod_setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target VoiceMod-Full-Version-Setup/Voicemod_setup.exe
- Size 146KB
- Sample240307-1g4etaef52
- SHA256 e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
- MD5 3d49478072bf18339ef810c8ea7546b2
- SHA1 c1047d72d4cdce21af4bb989ad1bee437edb7f80
- SHA512 f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
- SSDEEP 3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\3R9qG8i3Z.README.txt
Ransom Note
- ~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC1A1F6D683BC6194F >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.
URLs
-
https://t.me/mr_robot_unlock
Signatures
- Renames multiple (636) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 4945.tmp - Deletes itself 1 IoCs
pid Process 2164 4945.tmp - Executes dropped EXE 1 IoCs
pid Process 2164 4945.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini Voicemod_setup.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini Voicemod_setup.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP2mgq08icr55_mlvl4pvj8axyc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPie482w525480570jnzltyf0ld.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPp39c7cav5i26c1pdzlajqr1ud.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\3R9qG8i3Z.bmp" Voicemod_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\3R9qG8i3Z.bmp" Voicemod_setup.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 2164 4945.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop Voicemod_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "10" Voicemod_setup.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z Voicemod_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z\ = "3R9qG8i3Z" Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z Voicemod_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon\ = "C:\\ProgramData\\3R9qG8i3Z.ico" Voicemod_setup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe 416 Voicemod_setup.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp 2164 4945.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeDebugPrivilege 416 Voicemod_setup.exe Token: 36 416 Voicemod_setup.exe Token: SeImpersonatePrivilege 416 Voicemod_setup.exe Token: SeIncBasePriorityPrivilege 416 Voicemod_setup.exe Token: SeIncreaseQuotaPrivilege 416 Voicemod_setup.exe Token: 33 416 Voicemod_setup.exe Token: SeManageVolumePrivilege 416 Voicemod_setup.exe Token: SeProfSingleProcessPrivilege 416 Voicemod_setup.exe Token: SeRestorePrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSystemProfilePrivilege 416 Voicemod_setup.exe Token: SeTakeOwnershipPrivilege 416 Voicemod_setup.exe Token: SeShutdownPrivilege 416 Voicemod_setup.exe Token: SeDebugPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeBackupPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe Token: SeSecurityPrivilege 416 Voicemod_setup.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE 3772 ONENOTE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 416 wrote to memory of 4444 416 Voicemod_setup.exe 112 PID 416 wrote to memory of 4444 416 Voicemod_setup.exe 112 PID 2296 wrote to memory of 3772 2296 printfilterpipelinesvc.exe 115 PID 2296 wrote to memory of 3772 2296 printfilterpipelinesvc.exe 115 PID 416 wrote to memory of 2164 416 Voicemod_setup.exe 116 PID 416 wrote to memory of 2164 416 Voicemod_setup.exe 116 PID 416 wrote to memory of 2164 416 Voicemod_setup.exe 116 PID 416 wrote to memory of 2164 416 Voicemod_setup.exe 116 PID 2164 wrote to memory of 5036 2164 4945.tmp 117 PID 2164 wrote to memory of 5036 2164 4945.tmp 117 PID 2164 wrote to memory of 5036 2164 4945.tmp 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4444
-
-
C:\ProgramData\4945.tmp"C:\ProgramData\4945.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4945.tmp >> NUL3⤵PID:5036
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵PID:4736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1656
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9A200F6E-3C19-43C5-9835-12002CE09F91}.xps" 1335432137748500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\GGGGGGGGGGG
- Size 129B
- SHA256 9d342f7e81f43b2721c5f9822e8082b124a58d92c6356d8264a161f9f5690aab
- MD5 df02e7c1be3e34ef11664ec79e50b86d
- SHA1 1dec9e749f47eee12d541b3df00ba0f1f7a51811
- SHA512 63c16253589130f01f9e3a966b25bb1ec12cf11f64f0c28902929bd8f9acdd62b9a81c9060a8ab3fa57e87b2a6b4e4e4fe01884b1df0dc6b9007e2121dfd1664
- MD5 SHA1 SHA512
- Path C:\3R9qG8i3Z.README.txt
- Size 953B
- SHA256 e219577d7bcbb7441d2ed13d5925d445e10b07649de9253c7865b89b580883eb
- MD5 a8777d3060efddf79e4bd79fa5d12882
- SHA1 4a4ee344291e6723406f833d814c235a0132cd03
- SHA512 5d32b6d0ea92c57fbc780868349a48ed40203d9bf9cb6070938132933cefd0d56be6fabe473a9feb883cc5e1a6f33517414868129d0fd03e3b78fe1d4bde396a
- MD5 SHA1 SHA512
- Path C:\ProgramData\4945.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\DDDDDDDDDDDDDDDDDD
- Size 146KB
- SHA256 e5ed7d4690bf6e085cf6a9387ba9fbd8e4d77608a93aeebae79b6b0eb70ac283
- MD5 4fcf85fdcd8719f2621822dd1e261060
- SHA1 4d1faeca2b880b32005eae4129fce7d6c887a88f
- SHA512 f9aa458d8887968d3636681296e610e1e959d9d9004adba530719452143f5bcfee3c4690c18a98e2dbc9f7c377ab09fe728b6b68fef2283f30b666a7320da105
- SSDEEP 3072:J8vp74C/Ij0hOslAS7zs8vp74C/Ij0hOslAS7zs8vp74CV:J8vpT5Dzs8vpT5Dzs8vpx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{79ACE17C-CA85-40E6-827B-C2078D95D88C}
- Size 4KB
- SHA256 536fb8e4c4f41f94e4dd856fb4e28bdcfb602823a9bca02bd378124572df9dca
- MD5 aaa37a1e5b76e4713df416eb6d6a1c93
- SHA1 3d902c966028ce69929babc8a5664b9dabcdc77b
- SHA512 34d3311d7803a9f581cd1400aef42ba68818daa5e246276612b09abb110a2add8ca12b3fdd9b892e8d84ea50840d29885a871d7d10bebbd7b558672b2f05c435
- SSDEEP 6:RaZfjYyfB3h1RRXUnfr8SzlFKRHMhPMlrRujlw//0lweI/2EMlxRujd:RaNjYyf9/UfHz4m5Wf/1x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 bad92f89b31b0f5f78a1ff2a8d2e0f7f1dcb900f2232cf22e638f4bcf7c14f40
- MD5 3c07efc8025e6e8cbd52cf90c0c2a919
- SHA1 850f87cc3955dcc2352e20179b3cd505e2aaba9d
- SHA512 b8321536c5d84d8b00d56f4ba698a3ed070d02b2f4e18827cf5b1431317f35506670640921cf400b2952090fd453e31784ce5141123914db902e4fd2fa546d4d
- SSDEEP 12:RaNjYyfHj/UvIKz4m5W6/1S9hts1lWYEIxA/L:YNjYyfHY/bWLtKWY1Aj
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
- Size 129B
- SHA256 d1b8d60d334093f856a06f560c81fbc55331e9bbb5bccc6f19d53743d7954980
- MD5 358fdc0387b7da72c244ea80aa76e035
- SHA1 47d11997af979da87513b6bbb083d4d9a11d5a26
- SHA512 76cad5c94e922a6457cebc20e4c208f1d8c493ef7139e0f259feed8adb918bd40a6e2d32c3c0259f8185474687c38f91c3a9d6b4fe7bc0d4ec143da47bafd16a
- MD5 SHA1 SHA512