d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709

Analysis

max time kernel
145s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
Size

36.7MB
MD5

d0e692e9fd731170a037b45facabada6
SHA1

091a50a287e73283c64e9d5c269ea52595b3cc68
SHA256

d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709
SHA512

486ff9740c57bee383393726e369301d7e38a8c1693818d2181881be3da5e718ea224ffc87914fd76f1be7aed0e243dcca0650ff60fa10ef0cafac4fb51ba456
SSDEEP

786432:GM/eCRQ8pXYfPOb0cH2j6+s7LWB75zuBOoGkVW8QOd9+zDZe:/PQkXeObXH2qHWB75ixGkVWjZe

Score

7^/10

ransomware

Malware Config

Signatures

Loads dropped DLL 58 IoCs

pid	Process
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
25	pastebin.com
26	pastebin.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\1337VSPCOXZEZOMZBWHMHSWLUOVURQOJWJNNPCLVLBZEQXOTPEMNAWOCBBKKNNNBSBCSMTKKTXBFDSMYJQREWXEJXKZUVYPOEQRSKAKOdatura.jpg"	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\Desktop\WallpaperStyle = "6"	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\Desktop\TileWallpaper = "0"	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1856	2360	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe	90
PID 2360 wrote to memory of 1856	2360	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe	90
PID 1856 wrote to memory of 1588	1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe	92
PID 1856 wrote to memory of 1588	1856	d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe	92

C:\Users\Admin\AppData\Local\Temp\d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
"C:\Users\Admin\AppData\Local\Temp\d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe
  "C:\Users\Admin\AppData\Local\Temp\d437378baefff4fd038669158fcab40da23c791f230527ad3f25d038ce0b9709.exe"
  2⤵
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control