Overview

overview

10

Static

static

10

1f4e927f6e...a4.exe

windows7-x64

8

1f4e927f6e...a4.exe

windows10-1703-x64

8

1f4e927f6e...a4.exe

windows10-2004-x64

8

1f4e927f6e...a4.exe

windows11-21h2-x64

8

Resubmissions

26/03/2024, 14:35

240326-ryecksfd5y10

26/03/2024, 14:27

240326-rse2xsfb8y10

Analysis

  • max time kernel
    1799s
  • max time network
    1563s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
  • Size 2.2MB
  • Sample240326-ryecksfd5y
  • SHA256 1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 35 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 18 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe
    "C:\Users\Admin\AppData\Local\Temp\1f4e927f6e5ff4ae660f4d99194a9a7c05d5d829c6c3dbe1ee52a00fc740d6a4.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2968
  • C:\Windows\Explorer.EXE
    "C:\Windows\Explorer.EXE"
    1⤵
    • Modifies Installed Components in the registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Dont_Worry.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:2236
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x528
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2648

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Dont_Worry.txt
        • Path C:\$Recycle.Bin\Dont_Worry.txt
        • Size 738B
        • SHA256 d00e18a6aabc9c410cf6ed54974e57d13a29d30cf561e21f3f2d6155fbc2a07d
        • MD5 SHA1 SHA512
        Submit Download

        FormToolImages.jpg
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
        • Size 8KB
        • SHA256 5a5689624c2b494d2dd110c7aee5652bed64574b75b4c6074f5fd436e7a1ab9a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ViewHeaderPreview.jpg
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
        • Size 4KB
        • SHA256 736d175aced106724275204c30cd4c7f5198782262a2e2e54a2dc703a81c13e9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FormsViewAttachmentIcons.jpg
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
        • Size 6KB
        • SHA256 331caf22c558184bff9254fd4b084509fa1cb3a659472f04a9b07728ff53d956
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Office.InfoPath.xml
        • Path C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
        • Size 248KB
        • SHA256 be80e6775d9709d227c11aad167371fa30da6796e1f8588e092d113500c20c8d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        epl-v10.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
        • Size 13KB
        • SHA256 b99b8d2fc5466ed9a7864e29a43c4ba2c18335126fa10765758fff8069873100
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        license.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
        • Size 10KB
        • SHA256 c6437804ea4b38fb25ce21785621da866202063f33e007b8ac7e6f6708988d24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        asl-v20.txt
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
        • Size 12KB
        • SHA256 753675fc8f6554ddb9802fb4311287d95464b33642096070c8ce3db2057585a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {5104CC3B-7FAE-455A-B937-96CF29EE6732}[email protected]
        • Path C:\ProgramData\Microsoft\Windows\Caches\{5104CC3B-7FAE-455A-B937-96CF29EE6732}[email protected]
        • Size 3KB
        • SHA256 7cfbdb75eada029c384a971b541fe3c52ad42629c63cc2ddaf9f3016f5a57aa6
        • MD5 SHA1 SHA512
        Submit Download

        {6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
        • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}[email protected]
        • Size 191KB
        • SHA256 90e99233894e36eace482dc64707780fda7b2e4cd3795f749dd945fcfc0da754
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {8F7DDD68-8841-4710-B59A-3757534D6319}[email protected]
        • Path C:\ProgramData\Microsoft\Windows\Caches\{8F7DDD68-8841-4710-B59A-3757534D6319}[email protected]
        • Size 2KB
        • SHA256 e1e0384117d469abd9f1fca3685b903900ddc642606b56c10b00290d370903b7
        • MD5 SHA1 SHA512
        Submit Download

        {903DD0CF-3A33-450D-83A4-DAC0BCA06155}[email protected]
        • Path C:\ProgramData\Microsoft\Windows\Caches\{903DD0CF-3A33-450D-83A4-DAC0BCA06155}[email protected]
        • Size 2KB
        • SHA256 39e90984b2c1abfe8cce477ab01379dae734ba058e72a6358e51d9f4392c556c
        • MD5 SHA1 SHA512
        Submit Download

        {903DD0CF-3A33-450D-83A4-DAC0BCA06155}[email protected]
        • Path C:\ProgramData\Microsoft\Windows\Caches\{903DD0CF-3A33-450D-83A4-DAC0BCA06155}[email protected]
        • Size 2KB
        • SHA256 d70c1d16afdea59689c69899ce1fcfb7ba5975c26a1d7ad55a1fbc3571480f3b
        • MD5 SHA1 SHA512
        Submit Download

        {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
        • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}[email protected]
        • Size 406KB
        • SHA256 b00f7a0d1c99ff89594ae6ec939df6bdd8a02ce6c4f57d264e1785127a9f4a8a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_2
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2
        • Size 9KB
        • SHA256 4ed570761eec89144507bf6e75bd6c599966d205593a9347584854a00c66da07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_0
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
        • Size 9KB
        • SHA256 2f401deb4ebda4adc9a970986e90d8a8db653a7119f276be98ef7a1c128aa775
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        data_1
        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
        • Size 265KB
        • SHA256 33a8e85289aea5669fbf57b75b45dcabce80133beed5bae812336b92974fcd4d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        edbres00001.jrs
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs
        • Size 2.0MB
        • SHA256 537ca02192af9d9351ad785690fb23d6ec026516d1d195e0ec60b7f94791e992
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2823318777ntouromlalnodry--naod.sqlite
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xkoyglns.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
        • Size 49KB
        • SHA256 861db44e05f4d12dd740229100e72cf4dc0248db32bea9d0bb2b94851be2e5c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        [email protected]
        • Path C:\Users\Admin\Desktop\[email protected]
        • Size 288KB
        • SHA256 bcbe9a16c09df615f25f0806c13df4ddc5d75987bdcd13165d76a6301bb47668
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        [email protected]
        • Path C:\Users\Admin\Desktop\[email protected]
        • Size 800KB
        • SHA256 06af8baf31fd0b3ceeec7af64b3423f006976349860a28b02ccb7c7ea94ec490
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        [email protected]
        • Path C:\Users\Admin\Desktop\[email protected]
        • Size 493KB
        • SHA256 34ddddd43d3e35edbef4d1357a80760ac17f3e98a6915f1c62606035458f8f64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        [email protected]
        • Path C:\Users\Admin\Desktop\[email protected]
        • Size 513KB
        • SHA256 6b3a7f3e54d3e157a106de55b37bdc62732f578e4ee7720b9ea22ecfd8db5036
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Adobe Reader [email protected]
        • Path C:\Users\Public\Desktop\Adobe Reader [email protected]
        • Size 3KB
        • SHA256 8de038392505153f04c0c6d5ef90c59ab2d76e98f5c6ca8953e8f0b65bb4a53b
        • MD5 SHA1 SHA512
        Submit Download

        [email protected]
        • Path C:\Users\Public\Desktop\[email protected]
        • Size 2KB
        • SHA256 1d6bcd03ee22d1d8f03621df98c5688a6beacf9302e6aa9a13d829a3e7531331
        • MD5 SHA1 SHA512
        Submit Download

        Google [email protected]
        • Path C:\Users\Public\Desktop\Google [email protected]
        • Size 3KB
        • SHA256 e09f3193a1efe30d45f8abe8abc5061eb4f5e91cdad8e7b0b1a6a4d11f4d0917
        • MD5 SHA1 SHA512
        Submit Download

        VLC media [email protected]
        • Path C:\Users\Public\Desktop\VLC media [email protected]
        • Size 2KB
        • SHA256 4acce54eb4af5bd26feefd7a12326671caf2d460c794c0db284115aafbf527ce
        • MD5 SHA1 SHA512
        Submit Download

        SqlPersistenceProviderLogic.sql
        • Path C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
        • Size 14KB
        • SHA256 d64320fda2cd2f18fd45d708135d44f24aff3b22f9455d1b756460a939bfeb9d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SqlPersistenceProviderLogic.sql
        • Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
        • Size 14KB
        • SHA256 9adbd2fffc5e7bf27fd7cdff33daee1b353b9f2484e45e0ef86ba63035dccd2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2324-16556-0x0000000003C50000-0x0000000003C60000-memory.dmp
        Download

        memory/2324-16554-0x0000000004B00000-0x0000000004B01000-memory.dmp
        Download

        memory/2324-16561-0x0000000004B00000-0x0000000004B01000-memory.dmp
        Download

        memory/2968-15592-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-15749-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-14385-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-9767-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-16399-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-5285-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-16506-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-16559-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-16560-0x0000000000400000-0x000000000064A000-memory.dmp
        Download

        memory/2968-16562-0x0000000000400000-0x000000000064A000-memory.dmp
        Download