Analysis

  • max time kernel
    165s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 04:11

General

  • Target

    4cefaa9c547f282b73828d5330a47d774fbf23e9cdafe1e4dc7507e9415ddb3e.exe

  • Size

    145KB

  • MD5

    34e55b241ba3693f35112330357a8edf

  • SHA1

    5fb869a2d2f3de24e756c576f022781c4b74598e

  • SHA256

    4cefaa9c547f282b73828d5330a47d774fbf23e9cdafe1e4dc7507e9415ddb3e

  • SHA512

    d3014fb73ad252eb94fd514a3b8e897eb3df93dfc217f8ee21c0e7d038fd98702005ea0edb849987ff271472fa5ea2d655176acb3e059325f268bb8ca76a7053

  • SSDEEP

    3072:u6glyuxE4GsUPnliByocWepfVxexiPIIV:u6gDBGpvEByocWepeYV

Malware Config

Signatures

  • Renames multiple (643) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cefaa9c547f282b73828d5330a47d774fbf23e9cdafe1e4dc7507e9415ddb3e.exe
    "C:\Users\Admin\AppData\Local\Temp\4cefaa9c547f282b73828d5330a47d774fbf23e9cdafe1e4dc7507e9415ddb3e.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3392
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:380
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:3676
      • C:\Windows\system32\printfilterpipelinesvc.exe
        C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
        1⤵
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
          /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3809BA42-D8C7-4FF4-B891-7115CD5CA3FE}.xps" 133548631902100000
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:4772

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini

        Filesize

        129B

        MD5

        9b9c19145ae3c99e5fb313e2449ce306

        SHA1

        3d568c1f7fbd6c6926bb473eb392e323fbd57c72

        SHA256

        1f7f03023d38c4e33544c58380950691556556d52244981028b9faf933ff7d8b

        SHA512

        fe88038223b7ba0756a50e4016ebe714d36aa3ad899a7433382002c4172fe38b72843675504bc54ebfcb9be9c9a0fd58654ccbc803e094e9548de1fcb3effbb6

      • C:\CHR4bQVWh.README.txt

        Filesize

        122B

        MD5

        1cd2c508680a93907346e98d6a1677e6

        SHA1

        42ab98d499046fe5477610f5c256aff0b0f5be5e

        SHA256

        f722457807534d1c563d6cfaa43e3a8b90d721dcef1d48c0a3921b4025cd6bda

        SHA512

        2757aeab0f7c2703e0dfb095b37aada25d2947d21c7c988e4dc4b842d07741f34e4f35447694bae5a60de374f6812c511fd912177c81f37a3efd578848ae574c

      • F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD

        Filesize

        129B

        MD5

        692267a09866f827ed957d44d85b6b6f

        SHA1

        a02c6746bcea0347e5b977bbe4daa3b205d39b31

        SHA256

        2457123234c1f2b2ef5f19203d7587300ca7bdf42fe5b013f1e1c846e134d128

        SHA512

        80692ad49546d5a5a2916db7bcd384255bedd9dca656b3402af253bbe29b7ad3aacd33eae66a081e3ce1faf56c2153b9697d55310b622b19085e9ce5825eea78

      • memory/2200-0-0x0000000003370000-0x0000000003380000-memory.dmp

        Filesize

        64KB

      • memory/2200-1-0x0000000003370000-0x0000000003380000-memory.dmp

        Filesize

        64KB

      • memory/2200-2-0x0000000003370000-0x0000000003380000-memory.dmp

        Filesize

        64KB

      • memory/2200-1324-0x0000000003370000-0x0000000003380000-memory.dmp

        Filesize

        64KB

      • memory/2200-1325-0x0000000003370000-0x0000000003380000-memory.dmp

        Filesize

        64KB

      • memory/2200-1329-0x0000000003370000-0x0000000003380000-memory.dmp

        Filesize

        64KB

      • memory/4772-2832-0x00007FF881A90000-0x00007FF881AA0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2831-0x00007FF881A90000-0x00007FF881AA0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2834-0x00007FF8C1A10000-0x00007FF8C1C05000-memory.dmp

        Filesize

        2.0MB

      • memory/4772-2833-0x00007FF881A90000-0x00007FF881AA0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2835-0x00007FF8C1A10000-0x00007FF8C1C05000-memory.dmp

        Filesize

        2.0MB

      • memory/4772-2837-0x00007FF8C1A10000-0x00007FF8C1C05000-memory.dmp

        Filesize

        2.0MB

      • memory/4772-2836-0x00007FF881A90000-0x00007FF881AA0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2838-0x00007FF881A90000-0x00007FF881AA0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2839-0x00007FF8C1A10000-0x00007FF8C1C05000-memory.dmp

        Filesize

        2.0MB

      • memory/4772-2840-0x00007FF87F9A0000-0x00007FF87F9B0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2841-0x00007FF87F9A0000-0x00007FF87F9B0000-memory.dmp

        Filesize

        64KB

      • memory/4772-2842-0x00007FF8C1A10000-0x00007FF8C1C05000-memory.dmp

        Filesize

        2.0MB