b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Size 145KB
Sample240318-ky38dadf6s
SHA256 01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716
MD5 7966a61801e560b0031ba0e7d5864456
SHA1 bb737041b092879f10e400a599e5301d186bb6d9
SHA512 475f41efdafcb2a19e3d0c47b824f13f7ad609412d5d99bd08346795e3f98a14c96ab62f1ff0305a9fffc8d6c025f7c4c2e8a1502bfdb17484add606539f94d6
SSDEEP 3072:pqJogYkcSNm9V7DF78cwcmphqvbAw/rKfGT:pq2kc4m9tDp7wxhqnm
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Renames multiple (455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
748	340B.tmp

Executes dropped EXE 1 IoCs

pid	Process
748	340B.tmp

Loads dropped DLL 1 IoCs

pid	Process
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
748	340B.tmp

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe

Suspicious behavior: RenamesItself 26 IoCs

pid	Process
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp
748	340B.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeDebugPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: 36	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeImpersonatePrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeIncBasePriorityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeIncreaseQuotaPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: 33	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeManageVolumePrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeProfSingleProcessPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeRestorePrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSystemProfilePrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeTakeOwnershipPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeShutdownPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeDebugPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2096	vssvc.exe
Token: SeRestorePrivilege	2096	vssvc.exe
Token: SeAuditPrivilege	2096	vssvc.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeSecurityPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
Token: SeBackupPrivilege	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 748	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe	32
PID 2240 wrote to memory of 748	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe	32
PID 2240 wrote to memory of 748	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe	32
PID 2240 wrote to memory of 748	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe	32
PID 2240 wrote to memory of 748	2240	01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe	32
PID 748 wrote to memory of 2068	748	340B.tmp	33
PID 748 wrote to memory of 2068	748	340B.tmp	33
PID 748 wrote to memory of 2068	748	340B.tmp	33
PID 748 wrote to memory of 2068	748	340B.tmp	33

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe
"C:\Users\Admin\AppData\Local\Temp\01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716.exe"
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\ProgramData\340B.tmp
  "C:\ProgramData\340B.tmp"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\340B.tmp >> NUL
    3⤵
    PID:2068

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x14c
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini
Size 129B
SHA256 17324ec59d87bcf02328446774b6029fd75b3e9d8417f04425ac3d03f7ae8033
MD5 ecba07bea6a2a33c55f767bc77419b09
SHA1 0992a7fb77f9586ef560550fe2cb9dc51262f084
SHA512 624c7ea09165b95e4e4878b668a9e38e5af5a0b96889d4c4bac321b85a182431f47ba54ebce7379541ecf477d75db2ec3ef24496547052645ac765893cc8c9f9
MD5 SHA1 SHA512

Submit Download

DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Size 145KB
SHA256 12362827ff7d39c2efcb27bcea4364e67d5530934ed58f5e3ed2aa66a3a21e04
MD5 e1df215ac5db033f182b903749819111
SHA1 07032961f15f6d6f0c0eaea6ec01fcac3c9bf45b
SHA512 6bd88481d54af4dad60fdaa28c01afd046b477ed55c4aae9db1e715336d520f3b827e0b1eaf8674634811eaf3649db943a99a9fd5da9a71f9631898403e95660
SSDEEP 3072:BQktYJewgbzj5K1L04fc6QktYJewgbzj5K1L04fc6Qka:JYZgj5u0Gc8YZgj5u0Gcd
MD5 SHA1 SHA512 SSDEEP

Submit Download

fKwlk4hj5.README.txt

Path C:\fKwlk4hj5.README.txt
Size 629B
SHA256 5b1cd3fb03117987e4c51a67cd101796451f15babfacb9c9c2832908229d358c
MD5 6773e35f848ca075a81e3eeb19221820
SHA1 e3ba485887c73a7f2b6e278e8cc376b323502596
SHA512 88e27da84241b5a98e85d9ca7dc9eaae755401e899157676ee8dcccae023452f2a42a18c74ff8357eedf08836e930da4045a3dd7060cfaa992503d04852b8ec2
MD5 SHA1 SHA512

Submit Download

CCCCCCCCCCC

Path F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\CCCCCCCCCCC
Size 129B
SHA256 f32aa0ae54f79887534d7209683f42c925bfde9528a82303960f5bfc1521c30a
MD5 3eed67b9b8b7938dd04318d8cfe63d86
SHA1 096fe1eeb0f6636cfc656ad1cad53447c9ea4079
SHA512 b577a79cd4cdcb47f2fe27b3057b8fb9c96cb85fdf36a436932942530fd73cf5c4676678c5172a31896e579540d4339adbaeb820bed26d526112e9ba5f35f79e
MD5 SHA1 SHA512

Submit Download

340B.tmp

Path \ProgramData\340B.tmp
Size 14KB
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/748-970-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/748-971-0x00000000002A0000-0x00000000002E0000-memory.dmp

Download

memory/748-973-0x000000007EF80000-0x000000007EF81000-memory.dmp

Download

memory/748-974-0x000000007EF20000-0x000000007EF21000-memory.dmp

Download

memory/748-1002-0x000000007EF40000-0x000000007EF41000-memory.dmp

Download

memory/748-1005-0x000000007EF40000-0x000000007EF41000-memory.dmp

Download

memory/2240-0-0x00000000003A0000-0x00000000003E0000-memory.dmp

Download