Analysis
- max time kernel
1561s - max time network
1567s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
07/03/2024, 19:22
Behavioral task
behavioral1
Sample
VoiceMod-Full-Version-Setup/Voicemod_setup.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
1800 seconds
General
- Target VoiceMod-Full-Version-Setup/Voicemod_setup.exe
- Size 146KB
- Sample240307-x3cmfacf7w
- SHA256 e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
- MD5 3d49478072bf18339ef810c8ea7546b2
- SHA1 c1047d72d4cdce21af4bb989ad1bee437edb7f80
- SHA512 f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
- SSDEEP 3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\3R9qG8i3Z.README.txt
Ransom Note
- ~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FCF8BB6545A9FEBF92 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.
URLs
-
https://t.me/mr_robot_unlock
Signatures
- Renames multiple (329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 2916 D430.tmp - Executes dropped EXE 1 IoCs
pid Process 2916 D430.tmp - Loads dropped DLL 1 IoCs
pid Process 1692 Voicemod_setup.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3787592910-3720486031-2929222812-1000\desktop.ini Voicemod_setup.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3787592910-3720486031-2929222812-1000\desktop.ini Voicemod_setup.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\3R9qG8i3Z.bmp" Voicemod_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\3R9qG8i3Z.bmp" Voicemod_setup.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 2916 D430.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\Desktop Voicemod_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\Desktop\WallpaperStyle = "10" Voicemod_setup.exe - Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon\ = "C:\\ProgramData\\3R9qG8i3Z.ico" Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z Voicemod_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z\ = "3R9qG8i3Z" Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z Voicemod_setup.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe 1692 Voicemod_setup.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp 2916 D430.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeDebugPrivilege 1692 Voicemod_setup.exe Token: 36 1692 Voicemod_setup.exe Token: SeImpersonatePrivilege 1692 Voicemod_setup.exe Token: SeIncBasePriorityPrivilege 1692 Voicemod_setup.exe Token: SeIncreaseQuotaPrivilege 1692 Voicemod_setup.exe Token: 33 1692 Voicemod_setup.exe Token: SeManageVolumePrivilege 1692 Voicemod_setup.exe Token: SeProfSingleProcessPrivilege 1692 Voicemod_setup.exe Token: SeRestorePrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSystemProfilePrivilege 1692 Voicemod_setup.exe Token: SeTakeOwnershipPrivilege 1692 Voicemod_setup.exe Token: SeShutdownPrivilege 1692 Voicemod_setup.exe Token: SeDebugPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeBackupPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe Token: SeSecurityPrivilege 1692 Voicemod_setup.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 1692 wrote to memory of 2916 1692 Voicemod_setup.exe 31 PID 2916 wrote to memory of 3044 2916 D430.tmp 32 PID 2916 wrote to memory of 3044 2916 D430.tmp 32 PID 2916 wrote to memory of 3044 2916 D430.tmp 32 PID 2916 wrote to memory of 3044 2916 D430.tmp 32 PID 2916 wrote to memory of 3044 2916 D430.tmp 32 PID 2916 wrote to memory of 3044 2916 D430.tmp 32 PID 2916 wrote to memory of 3044 2916 D430.tmp 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\ProgramData\D430.tmp"C:\ProgramData\D430.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D430.tmp >> NUL3⤵PID:3044
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3787592910-3720486031-2929222812-1000\desktop.ini
- Size 129B
- SHA256 8789bd117f2aa6f969d03943924d8463ddafd7b28465d83d6ee389c7134f767e
- MD5 224111868bf0526b82379bd86dab7b78
- SHA1 a56e239f85a60664572dcf3ebd9dbf10f1cc90b4
- SHA512 2ff496b2b6a5537be0483f197580563389f800ed8c3201836c16c06d67a1ed4af87440420ea274fbbb609bbf8ead3bf1c34114d4dcb48d29a47649b3202502ef
- MD5 SHA1 SHA512
- Path C:\3R9qG8i3Z.README.txt
- Size 953B
- SHA256 39b1ffa3985b2257b33a12c06807ee4d235f3fbba976d6103de25bc2aad168c2
- MD5 1a45e3ec160192f7abebdb4c23f91c53
- SHA1 6810c5a9d48806c0d11f41854b8c63d2b9d471a9
- SHA512 0bdb04aa7ac49a3162249eabc214041b49cda0e8197b4bd967f8b7b451032568176138175c75d4457e1b0c5a6e7db51d94a3ffb165b6f9af24f59991d0d3b954
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\DDDDDDDDDDDDDDDDDD
- Size 146KB
- SHA256 54de3ca2ccb3b5636538de3e0c39be3fd9895d7f973b1ccdb67cf23a0ff54599
- MD5 f88ae5b5453394f4d5ffe2259f6343ab
- SHA1 4b3195143f87b462a7072ce957cb3c346893ac92
- SHA512 5610f185b6928d9aa847c9db53b0e880f192843eaabca02cc20dd432ec9c9155d76a8b1773da7900e27ecf3b457cc6d9c59157377b8dc8c1e991667ac2083e17
- SSDEEP 3072:iZdQeGLnn9hHCMD9VZdQeGLnn9hHCMD9VZdQeGV:wQL3QL3Ql
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-3787592910-3720486031-2929222812-1000\DDDDDDDDDDD
- Size 129B
- SHA256 87e588cafc55129f7afa62681d7a9299e2a87b06bf1ea900add5690e12d753f3
- MD5 a4cc23398e38d7b1262855197072f737
- SHA1 6c20320a4e92b77d8da01b6ede93b5507f13e7f1
- SHA512 f3f947e79215efe603c108f10277e75ace41bf04eb306fdd884ec1d5b27226775082b51d62472d1f6dbe110641aa75ca65482fb068d8debd0a747c1e817d3184
- MD5 SHA1 SHA512
- Path \ProgramData\D430.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP