Analysis
- max time kernel
146s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
09/03/2024, 01:10
Behavioral task
behavioral1
Sample
VoiceMod-Full-Version-Setup/Voicemod_setup.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
VoiceMod-Full-Version-Setup/Voicemod_setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target VoiceMod-Full-Version-Setup/Voicemod_setup.exe
- Size 146KB
- Sample240309-bjscwsba59
- SHA256 e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
- MD5 3d49478072bf18339ef810c8ea7546b2
- SHA1 c1047d72d4cdce21af4bb989ad1bee437edb7f80
- SHA512 f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
- SSDEEP 3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\3R9qG8i3Z.README.txt
Ransom Note
- ~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC527FFEDF8789C3A6 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.
URLs
-
https://t.me/mr_robot_unlock
Signatures
- Renames multiple (626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 508D.tmp - Deletes itself 1 IoCs
pid Process 3248 508D.tmp - Executes dropped EXE 1 IoCs
pid Process 3248 508D.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini Voicemod_setup.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini Voicemod_setup.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPm0our69090eejdmdnmcljg5t.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPj0x_a9hz00ufj1fv1ozkiwqzc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP5fnamnilt7jpcuzm15qiktut.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\3R9qG8i3Z.bmp" Voicemod_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\3R9qG8i3Z.bmp" Voicemod_setup.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 3248 508D.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop Voicemod_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallpaperStyle = "10" Voicemod_setup.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z Voicemod_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon\ = "C:\\ProgramData\\3R9qG8i3Z.ico" Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z Voicemod_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.3R9qG8i3Z\ = "3R9qG8i3Z" Voicemod_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\3R9qG8i3Z\DefaultIcon Voicemod_setup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe 880 Voicemod_setup.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp 3248 508D.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeDebugPrivilege 880 Voicemod_setup.exe Token: 36 880 Voicemod_setup.exe Token: SeImpersonatePrivilege 880 Voicemod_setup.exe Token: SeIncBasePriorityPrivilege 880 Voicemod_setup.exe Token: SeIncreaseQuotaPrivilege 880 Voicemod_setup.exe Token: 33 880 Voicemod_setup.exe Token: SeManageVolumePrivilege 880 Voicemod_setup.exe Token: SeProfSingleProcessPrivilege 880 Voicemod_setup.exe Token: SeRestorePrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSystemProfilePrivilege 880 Voicemod_setup.exe Token: SeTakeOwnershipPrivilege 880 Voicemod_setup.exe Token: SeShutdownPrivilege 880 Voicemod_setup.exe Token: SeDebugPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeBackupPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe Token: SeSecurityPrivilege 880 Voicemod_setup.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE 3524 ONENOTE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 880 wrote to memory of 2472 880 Voicemod_setup.exe 103 PID 880 wrote to memory of 2472 880 Voicemod_setup.exe 103 PID 2816 wrote to memory of 3524 2816 printfilterpipelinesvc.exe 106 PID 2816 wrote to memory of 3524 2816 printfilterpipelinesvc.exe 106 PID 880 wrote to memory of 3248 880 Voicemod_setup.exe 107 PID 880 wrote to memory of 3248 880 Voicemod_setup.exe 107 PID 880 wrote to memory of 3248 880 Voicemod_setup.exe 107 PID 880 wrote to memory of 3248 880 Voicemod_setup.exe 107 PID 3248 wrote to memory of 2232 3248 508D.tmp 108 PID 3248 wrote to memory of 2232 3248 508D.tmp 108 PID 3248 wrote to memory of 2232 3248 508D.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\Voicemod_setup.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2472
-
-
C:\ProgramData\508D.tmp"C:\ProgramData\508D.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\508D.tmp >> NUL3⤵PID:2232
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2108
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{1590CDAD-2178-4460-8F86-A26CFAA1B487}.xps" 1335442029985300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\BBBBBBBBBBB
- Size 129B
- SHA256 2cd691edbe22092fad81c5098e216d2144bdab58bddcbe3e86946ff8ea4706b7
- MD5 3689b733c1db5fdcf8bbfa608fd7ad3c
- SHA1 0104233e6efbfe5ad0cb3dd0c823547c8e2cb552
- SHA512 6f30edc8175b13e0fb7bb18b73999fcf18cc4c7e428c5edb536314ea2f73f26eb21e2056823f701a381245e77ff75d7923745df273452f5d3baaf1c16d89142d
- MD5 SHA1 SHA512
- Path C:\3R9qG8i3Z.README.txt
- Size 953B
- SHA256 bbf919691f45dff7ae82f294adea2a6cc71fbcefd0a2746b679184cd9909228c
- MD5 55964ca7d3341ad2a46731555a89ef5a
- SHA1 161b3f7b92d7e62d49ad6d40e4d2c836e348d8c5
- SHA512 e123997e2c7d34bc72c9b4b17521b1f9b49ca90ac47df4b998b75bc79ed6e772d375c96cedeb557dbdfe3c5124cbb1897025336fab267922eeee5b5c46aaae94
- MD5 SHA1 SHA512
- Path C:\ProgramData\508D.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\VoiceMod-Full-Version-Setup\DDDDDDDDDDDDDDDDDD
- Size 146KB
- SHA256 306785f983c55e76a0ef60bd36bbe150331f56e5fb7f09770fa33a323d05d1a6
- MD5 caca5dd2be1ffb6da465d910f521dc07
- SHA1 872581a2d01a46112d328794a43247e90ce07d84
- SHA512 3b0af33ed0547f077961b4dd01b408a30e3b67099f3f31e2219355e15786e6b3c01b98bf3599b092b5dcb79187281139a20158c39f212a88f2e24d5ec035e7d3
- SSDEEP 3072:iSKUOuMoe+D53Wi2xaT3MhbAmdMzSKUOuMoe+D53Wi2xaT3MhbAmdMzSKUOuMoea:4uneY53J2xSMh1dMFuneY53J2xSMh1dD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{88A13D01-E003-4113-A5C4-6BAE01396B0C}
- Size 4KB
- SHA256 f53af23ef651b4169e14776ccbb75cbcec7235f99b5c2f098c47b604d9034aa6
- MD5 1237cbca645a84483f372396eb2b287d
- SHA1 e8cff5a134ad88c2a218bd3dfc3be422f2750674
- SHA512 c8d1a3c453267d5afcf4e8a52a742df9b536b7b66fe729eb18ddc277b10de1ba2d3cf3c3929d5d811f988b4feefb1ab3997b850cc2e68675719f0563daffb2b0
- SSDEEP 6:RajWVYyfB3h1RRXUnfoTP4awbjltMta8FKbTLykkiykbRujlw//0lweI/OiykBR0:RaqVYyf9/Ufor4a6t+8RUWf//8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 95e53d5e2c5ff9021689217fa961dcadfbac08ff980af9a2336955bfb5c5d951
- MD5 7f03bc914ee2ef635ee34dda98bcd59b
- SHA1 c20371c3c1e7c7428ce347897fe951cda0c1b97b
- SHA512 e6de260b9afd487ebfe00b4df51c5ee1b4ae3224e6882f4cf40c2658d51b807d563be4bff0e4ba83b89ca1867bdc81e13c068349458396f6ae0a6ff1a5eb35db
- SSDEEP 12:RaqVYyfHj/UvyPIm8RUW6//xHnl8EIxA/L:YqVYyfHYOIeXHl81Aj
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\DDDDDDDDDDD
- Size 129B
- SHA256 dbcef6a063947c4de76b2b2cd2c5faf0a7ea6b9cb9045747cfa11bace1acbcf2
- MD5 33d4bc12d36122cca37b72578e19bfd8
- SHA1 e9e16dda212ff092068f15f0009dd7ab3fda1089
- SHA512 92bd6fe501f422efc968a4a74519b51ed7437e615526d9afdec063f70dbb2a60bad81bd7be6f7604a48b79a6d8f2710d0d2f33a3a1e7844d54af3e0ea3b1cd39
- MD5 SHA1 SHA512